AD domain migration With AAD connect passthrough authentication

jpcapone 1,421 Reputation points
2020-08-27T19:47:32.187+00:00

What is the best way to migrate AAD connect to the new Active Directory domain when performing an AD migration? With password hash syncing it would be easy to perform the cutover but I am not sure how to do that when AADC is set to passthrough.

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,456 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,449 questions
0 comments
Accepted answer
  1. AmanpreetSingh-MSFT 56,561 Reputation points
    2020-08-28T08:17:15.603+00:00

    Hello @jpcapone

    In case of Pass Through Authentication (PTA), PTA agents are used to facilitate the authentication from On-premises AD. So, once your migration is completed, you would need to install PTA Agents in the new domain and uninstall all the existing agents in the old domain. Once the agents are uninstalled, outbound connection to AAD won't exist from the old domain and the Agent status will become inactive. Inactive agents are removed automatically from the AAD tenant after 10 days of inactivity and can't be removed manually. However, authentication requests will only be sent to the Active Agents. So make there is no active PTA agent in old domain as after migration all authentication requests should go to the new domain.

    I would strongly recommend you to test it in Dev environment before performing it in the production.

    As a failover plan, you may consider configuring PHS as a backup through "Customize synchronization options" > connect to Azure and AD > Optional features > PHS.

    Note: This will just act as a backup and PTA will remain your primary mode of authentication. Authentication will not fallback to PHS automatically and you would have to manually switch to PHS if needed.

    -----------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.
    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jon Alfred Smith 541 Reputation points
    2020-08-27T19:55:40.44+00:00

    You should change the authentication to password hash sync. With PTA you still need at least one local DC to authenticate your users. This won't work with a cutover.
    https://video2.skills-academy.com/en-us/azure/active-directory/hybrid/how-to-connect-pta

    1 person found this answer helpful.
    0 comments
  2. jpcapone 1,421 Reputation points
    2020-08-27T21:07:49.637+00:00

    Is that the only option we have for migrating Active Directory domains? If we were willing to live with the down time could we uninstall AAD connect in the source domain and reinstall it in the target domain?

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.