Source
r/AZURE•
lcourage

Azure AD migrating from cloud to on-premises

Has anyone migrated a fully developed Azure AD to on-premises DCs?

I work at a small tech start-up that grown. We have been using Azure AD for years with O365, security groups, enterprise apps, etc. I setup AD DS a while back and it has been worked great for our vms in Azure. Up until now we’ve been strictly cloud based. We now have the need to build some on-premises labs and other devices. I was hoping to use AAD Connect to migrate AAD to an on-premises DC. My goal was to have one DC in Azure and one on-prem. After researching AAD Connect it seems there is no way to migrate from cloud to on-premises, only the other way around.

I have found some way to export users from AAD to import to a local DC. There are some issues with having to re-enter passwords. My fear is that no security groups or groups in general will be synced. AD is not my strong suite. Through testing I’m not able to fully test out all possible issues because we have so much stuff going on in Azure AD. I’m worried doing a AAD Connect sync will possibly delete functioning parts of AAD. Is it really as easy as exporting the users and loading them into a local AD?

Posted Oct 26, 2018, 9:47 PM UTC

15
CptMannering•

Do you have Azure AD Directory Services deployed? Do you have a VPN or Express Route circuit back to on-premises? If you have those things, you don't really need an on-premises AD, just connect the labs to AADDS. But if you really need a local AD, setup a VM and when you dcpromo select connect to an existing AD. You may need some help from MS team to get a user with the correct permissions, but shouldn't be a major.

3
lcourageOP•

Going to setup a S2S VPN and give a shot. Thanks for the info.

1
kdg4•

I think the easiest way to achieve what you want (while still not ideal) would be just to expire user passwords and enable writeback. Once all users have changed their passwords (and hence, the new passwords have been written back to on prem AD) you’d be good to go.

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-writeback

It does require AAD Premium licenses for all your users though.

2
lcourageOP•

Thanks for the info.

I'll give it a shot and let you know.

1
Surreal7niner•

FYI, this is what I was going to suggest. Password Writeback.

1