Month: September 2015

Azure AD is a great new subscription based product from Microsoft, perfect for Apps and Cloud Backups, however adding a custom domain and configuring it for single sign-on with you local Active Directory can be tricky. After deleting my custom domain twice and all my synced users once, we discovered this to be the easiest way to setup single sign-on in Azure.

Prerequisites

• Active Directory Federation Services must be installed and configured
• A Global Administrator on Azure Active Directory
• A Enterprise Administrator on your domain

Instructions

1. Add the domain to Azure Active Directory. Check the “I plan to configure this domain for single sign-on with my local Active Directory.”
2. Add a User. The user will be a “New user in your organization” and must have Global Administrator priveleges. We created “azure@pandatech.onmicrosoft.com“
3. Sign in with the new user and update the password.
4. Get the code for verifying the custom domain by opening an elevated PowerShell session and running the following commands:

   $cred = Get-Credential
   Connect-MsolService -Credential $cred
   Get-MsolDomainVerificationDns -DomainName "pandatech.co" -Mode -DnsTxtRecord

   Enter the new user’s credentials in the prompt that opens after the first command. Then replace the last command with your own custom domain name. See the example output below:
   

5. Create TXT record with the Alias or Hostname @ and the Address from the PowerShell results. Below is my record:
   
6. Depending on your host and the internet, it may take a while before the DNS records update. Once they do you will need to run the following command:

   New-MsolFederatedDomain -DomainName "pandatech.co"

   If the DNS records have not updated yet, you will get an error. Once completed, the custom domain should appear as “Verified” in Azure AD. Successful PowerShell results look like this:
   

7. On a Domain Controller, install download and install Microsoft Azure Active Directory Connect.
8. Run Azure AD Connect using the Express Settings, and sign in with the account you created in Step 3 on the first page. Sign in with an Enterprise Administrator on your domain in the second page. Check “Start the synchronization process as soon as the configuration completes”, and click Install.
   
9. Installation should complete within a few minutes. The sync will automatically begin afterwards, and it may take some time depending on the size of your domain and your internet speed.
10. Verify that accounts appear in Azure AD afterwards, and try signing into the Azure Portal with one of your local accounts.

Hopefully this helps you configure single sign-on in Azure with your local Active Directory. Post any questions in the comments. You may also find Microsoft’s Azure AD Directory Integration documentation helpful as well.