Directory integration

Article
03/09/2016

Updated: June 24, 2015

Applies To: Azure, Office 365, Windows Intune

If your organization has an on-premises directory service, you can integrate it with your Microsoft Azure Active Directory (Microsoft Azure AD) directory and embrace the Microsoft enterprise-grade cloud service, IT governance and self-service capabilities, thus improving your end-user productivity, enable compliance, and reduce administrative costs.

Extending your on-premises directories to Azure AD provides the following benefits:

Simplifying your cloud-based administrative tasks
Providing your users with a more streamlined sign-in experience
Obtaining single sign-on to all cloud-based applications
Securely and seamlessly managing your user and device identities, both cloud and on-premises, through a unified experience
Managing your first- and third-party applications, SaaS and other existing enterprise cloud and on-premises applications through a unified experience

For more information, see Similarities between Active Directory and Azure AD.

In this section

Supported directory integration scenarios
Directory integration tools
AAD Connect

Supported directory integration scenarios

Important

An important part of planning your hybrid identity infrastructure (extending your local directories to Azure AD) is determining how you want to administer your directory, as well as how your users will sign into Microsoft cloud services. For more information and a high-level matrix of benefits and features provided with each of these scenarios, see Determine which directory integration scenario to use.

Azure AD supports the following four directory integration scenarios:

Directory synchronization is also referred to as directory sync. Once directory sync has been set up, administrators can manage directory objects from your on-premises Active Directory and those changes will be synchronized to your tenant. In this scenario, your users will use different user name and passwords to access your cloud and on-premises resources.
DirSync with Password Sync – Used when you want to enable your users to sign in to Azure AD and other services using the same user name and password as they use to log onto your corporate network and resources. Password sync is a feature of the Directory Sync tool.
DirSync with Single Sign-On - Used to provide users with the most seamless authentication experience as they access Microsoft cloud services while logged on to the corporate network. In order to set up single sign-on, organizations need to deploy a security token service on-premises, such as Active Directory Federation Services (AD FS). Once it has been set up, users can use their Active Directory corporate credentials (user name and password) to access the services in the cloud and their existing on-premises resources.
Multi-forest - DirSync with Single Sign-On - Used to provide users with the most seamless authentication experience as they access Microsoft cloud services while logged on to the corporate network. In order to set up single sign-on, organizations need to deploy Active Directory Federation Services (AD FS) as security token service on-premises. Once it has been set up, users can use their Active Directory corporate credentials (user name and password) to access the services in the cloud and their existing on-premises resources.