Directory Integration Tools Feature Comparison

The following charts provide a comparison of the features that each of the three tools currently supports for synchronizing your directory with Azure Active Directory. You can use these charts to help determine which tool is the correct one to use for your situation.

Important
CS = Coming Soon!

 

On-Premises to Cloud Synchronization

Feature

Azure Active Directory Synchronization Tool (DirSync)

Azure Active Directory Synchronization Services (AAD Sync)

Forefront Identity Manager 2010 R2 (FIM)

Connect to single on-premises AD forest

X

X

X

Connect to multiple on-premises AD forests

 

X

X

Connect to single on-premises LDAP directory (no AD at all)

 

CS

X

Connect to multiple on-premises LDAP directories

 

CS

X

Connect to on-premises AD and on-premises LDAP directories

 

CS

X

Connect to custom systems (i.e. SQL, Oracle, MySQL, etc.).

 

CS

X

Synchronize customer defined attributes (directory extensions)

CS

CS

 

 

Cloud to On-Premises Synchronization

Feature

Azure Active Directory Synchronization Tool (DirSync)

Azure Active Directory Synchronization Services (AAD Sync)

Forefront Identity Manager 2010 R2 (FIM)

Write-back of devices

X

CS

 

Attribute write back (for Exchange hybrid deployment )

X

X

X

Write-back of users, groups objects

CS

CS

 

Write-back of passwords (from SSPR and password change)

CS

CS

 

Write-back of customer defined attributes (directory extensions)

CS

CS

 

 

Authentication Feature Support

Feature

Azure Active Directory Synchronization Tool (DirSync)

Azure Active Directory Synchronization Services (AAD Sync)

Forefront Identity Manager 2010 R2 (FIM)

Password Hash Sync for single on-premises AD forest

X

CS

 

Password Hash Sync for multiple on-premises AD forests

 

CS

 

Federation (SSO)

X

X

X

 

Set-up and Installation

Feature

Azure Active Directory Synchronization Tool (DirSync)

Azure Active Directory Synchronization Services (AAD Sync)

Forefront Identity Manager 2010 R2 (FIM)

Supports installation on a Domain Controller

X

X

 

Supports installation using SQL Express

X

X

 

Step-up from DirSync to AADSync

     

Localization Windows Server languages)

X

CS

 

Support for Windows Server 2008 and Windows Server 2008 R2

X

X

X

Support for Windows Server 2012 and Windows Server 2012 R2

X

X

 

 

Filtering and Configuration

Feature

Azure Active Directory Synchronization Tool (DirSync)

Azure Active Directory Synchronization Services (AAD Sync)

Forefront Identity Manager 2010 R2 (FIM)

Filter on Domains and Organizational Units

X

X

X

Filter on attribute values on objects

X

X

X

Allow minimal set of attributes to be synchronized "MinSync"

 

X

 

Allow different service templates to be applied for attribute flows

 

X

 

Allow removing attributes from flowing from AD to AAD

 

X

 

Allow advanced customization for attribute flows

 

X

X

Tags:

Issue with accessing the DirectAccess console after removing a Domain Controller

Most people don't know that the DirectAccess servers are tied together with a specific domain controller. In case you decommission the specific domain controller due to upgrade or other reasons the Direct Access console will become inaccessiable.

Symptom:
Unable to open the DirectAccess configuration in the “Remote Access Management Console”
Error message unable to load configuration from “Server.domain.tld”
Error message about missing access permission on the GPO object.

Cause:
DirectAccess server has a specific EntryPointDc that is used for reading/writing GPO and AD settings.
You can see the settings using the Get-DAEntryPointDC cmdlet on DirectAccess servers.

Use get-DAEntryPointDC

EntryPointName       : DirectAccess-AU.domain.com
DomainControllerName : Server.domain.tld

EntryPointName       : DirectAccess-CN.domain.com
DomainControllerName : Server.domain.tld

EntryPointName       : DirectAccess-DK.domain.com
DomainControllerName : Server.domain.tld

EntryPointName       : DirectAccess-US.domain.com
DomainControllerName : Server.domain.tld

Fix:
This powershell will change any Entrypoint domain controllers that has “ExisitingDC” name:
Set-DAEntryPointDC –ExistingDC "Server.domain.tld" -NewDC "Server.domain.tld" –Force -PassThru
 

More information

Set-DAEntryPointDC: http://technet.microsoft.com/en-us/library/hh918412.aspx

Troubleshooting Setting the Entry Point Domain Controller: http://technet.microsoft.com/en-us/library/jj591656.aspx

 

Tags:

Microsoft Azure Automation - Creating Azure Automation Modules

This video shows how to make Azure Automation Modules that can be used to extend the standard capabilities in Microsoft Azure Automation.

Tags:

Microsoft Azure Automation Start and Stop Virtual Machines using Runbooks

This short guide will show you how to use Microsoft Azure Automation for managing the start and stop of your Microsoft Azure Virtual Machines.

This guide provides to PowerShell Automation script for Azure Automation:

  • Workflow: Start_My_Azure_VMs - Start_My_Azure_VMs.ps1 (5.26 kb) - Script for starting domain controllers first and than all the rest of the virtual machines on your Azure Subscription
  • Workflow: StopMyAzureVMs - StopMyAzureVMs.ps1 (4.97 kb) - Script for shutting down all virtual machines on your Azure Subscription

See the functionality of the scripts here:

Implementation of the scripts

Here are the steps needed to get everything up and running.

  1. Sign into the Windows Azure Portal (https://manage.windowsazure.com)
  2. Subscribe to Azure Automation Preview
  3. Create an Automation Acount (For more information: http://azure.microsoft.com/en-us/documentation/articles/automation-create-runbook-from-samples/?WT.mc_id=Blog_SC_Automation_Azure)
  4. Create the "Asset" for the Runbooks
  5. Upload the previously downloaded Automation Runbooks to the Automation Account
  6. Change the names in the Runbooks to reflect the assets and the Domain controllers

 Sign into the Windows Azure Portal and subscribe to Automation Preview 

Sign in to the Azure Portal and navigate to Automation.

 

 Create the Automation Assets

 Create a Certifcate Asset (It must be a Management Certificate) and a connection asset.

 

Connection Asset:

Certificate Asset:

 

Download the Runbooks and upload them to the Automation Account:

Download the files

Start_My_Azure_VMs.ps1 (5.26 kb)

StopMyAzureVMs.ps1 (4.97 kb)

Upload the files to the accounts

 

Change Asset names and information with the Runbooks

 

/Peter 

 

Tags:

Microsoft Windows DirectAccess Client Troubleshooting Tool

I'm pleased to announce that Microsoft have just released an awesome troubleshooting tool for DirectAccess clients called "Microsoft Windows DirectAccess Client Troubleshooting Tool".

 

Get the tool here: http://www.microsoft.com/en-us/download/details.aspx?id=41938

 

 

Tags: