Secure Microsoft 365 Hybrid Environments

0:00[MUSIC PLAYING] I would like to congratulate you, my friend, for taking this bold step to pursue the Microsoft 365 Security Administration certification. Now, most of the times, when [INAUDIBLE] begin a new course, we spend countless hours online trying to figure out whether that course is the best fit for us. And it is important for us, definitely, as we begin this course to figure out whether we are the perfect fit for the course. Apart from that, we also simply want to know what exactly is covered in the course, what is the content of the course.

0:32And perhaps are there any prerequisites for us to actually have prior to us taking these particular course? Now if you're going to take the exam, which is the Microsoft-500 exam, for this particular course, it is important that you have a few things or a few tools in your kit prior to you going for this particular exam. I would recommend strongly that you should be familiar with Microsoft Azure. It becomes a very important tool as you go further. It may also be very, very important for you to be familiar with the various tools and services that we run on-prem.

1:03And other than that, yes, Microsoft 365 becomes very important, your SharePoint, your OneDrive, your Teams, and everything else that comes with this particular package. Now, am I the rightful fit? Well, you actually could be very excited as I am in this particular course. But, definitely, it's important for us to know what exactly are we currently doing. Are you somebody who is dealing with Microsoft systems? Perhaps managing or administering some Microsoft 365 services or some Azure services? And if you are, it becomes very important for you to know how you can go about securing that environment.

1:35And this is where the MS-500 becomes very important for us to simply delve into. Well, if you're currently maybe in a space where you hardly work with all the Azure stuff but you've been working with some Windows environment on-prem, could be an Active Directory or any other on-premise service, it's important, too, that you begin familiarizing yourself with the various tools with which you could secure the most important resources that you may have within the cloud. Now, for the exam and the course in particular, there are four different domains that we have to cover as part of the content. We have the first domain, which is known as the implement and manage identity domain.

2:07And, actually, in this particular domain are many subdomains or other skills that are covered therein. So we are going to cover things such as securing identities, implementing authentication methods, et cetera. So this is the section we are going to look at how we can configure multifactor authentication, how we can work with SSPR, and many of the things that are very important for the security of the users that we have within our environment. We'll also look at implementing and managing threat protection, a very important part that actually looks at how we can use tools such as Microsoft Defender.

2:38And if you're still doubtful or skeptical of Microsoft Defender capabilities like I used to be in the past, you would actually be amazed or impressed by the virus solutions that it actually provides from the various endpoint solutions to Defender Application Guard and Defender Application Control and many of the tools where there are features that we can use to protect our devices from various cloud-based threats. Once we've covered that part, we are going to look at implementing and managing information protection. Now, this is one domain that is near and dear to my heart. Why do I say so?

3:08Simply because I am also concerned with how any organization out there is going to be handling my personal identifiable information. If your organization is going to be handling anything from my age, my name, my Social Security number to my driver's license, details, and everything else, I would be concerned with how you're going to be securing that type of data. And in this particular domain, we are going to look at how we can go about configuring sensitivity levels and various types of policies that would simply position our systems and various administrators who are actually handling this data to be in such an environment, whereby this kind of information is regarded as sensitive so that in any event of communicating with various stakeholders and other users who would actually not be part of our organization, these users who are handling this type of data could actually be notified to say, hey, you are about to share something that is regarded as very sensitive.

3:57We're also going to look at how we can configure data loss prevention. OK, very important stuff that is actually covered in this particular domain. The final domain that we're going to look at is managing governance and compliance features within Microsoft 365. Now this is very important, friends. This is where we're going to look at how we can do our audit logs, how we can do our reports. And if you actually thought that this is an entirely technical course, well, you're actually mistaken because the report section could actually be done by various stakeholders who could be in different departments, who simply want this kind of information for various types of legal reports or maybe submission of various compliance, regulatory forms, and everything else that needs to be shown as proof that we are compliant with the various regulations and requirements that actually need us to continue operating in the space that we operate as an organization.

4:45So these are the various domains that we have to cover. And I cannot wait, to be honest, to work with you through the various demos that we have to do as we delve into this particular course. And, of course, like I said earlier on, it is important for you to actually be familiar with the various features such as Azure Active Directory and the various Microsoft 365 features. However, this is not really a hard-coded requirement. You could still actually tag along as we go through it and be able to pick those pieces as we proceed. Now without further ado, let's dive into our first Nugget.

0:06Thank you for joining me in this Nugget as we look at Azure Active Directory authentication options. Now, if you would like to come along with me and go through each and every part as I would be actually doing these demonstrations, I would highly recommend you to get a free Microsoft 365 subscription, which is a trial version, which you can try out these things. However, you'll also realize that the MS-500 exam or the Microsoft 365 Security administration course focuses more on ensuring that users are familiar with both Azure, as well as the various on-prem environments that you may simply have in your environment.

0:41In short, this course is actually ideal for users who are managing a hybrid environment. So as much as we would like to do things in Azure and Microsoft 365, it is important for you to have some form of on-prem environment that you can create. And this could be your virtual machines in Hyper-V or if you're running a VM environment with ESXi, let's say, version 6.5 or version 7, and you're able to simply spin some virtual machines in there. That would actually become ideal. So what I would simply want to do in that case is to simply spin up one virtual machine that we can use as a domain controller for the environment.

1:16It doesn't matter how [INAUDIBLE] are used really, how everyone comes to the operating system. I would recommend that you use Windows Server 2016 or later. You'll also need to have access to a domain that you can administer and make changes to, and this is the domain that you would need to register with Microsoft 365 in the cloud. And at the same time, the domain should also be in your domain controller. And like I said, it isn't really very important that you stick to a particular hypervisor, but if you're able to stick with, let's say, Hyper-V, I'm pretty sure that would work great.

1:49So like in my case, I have Hyper-V over here. You would simply have to go and create your new virtual machine. And from that virtual machine, you then go ahead and run your server operating system. Like I said, the hypervisor you're going to be using is not a big issue, so you'll notice that most of the demos that will be running will be in VMware ESXi. And in this environment, I have my Windows Server 2022. Don't worry much about the version. If you can't get hold of Windows Server 2022, 2019 and 2016 still have very similar features, and you'll be able to follow along using those versions of Windows Server.

2:22So in this particular environment, the most important thing is for you to ensure that whatever server that you have, which is going to be running as a domain controller, has the same domain as the one that you're having within your Microsoft 365 environment. So the main objective over here is for us to be able to link these two environments, our cloud environment, as well as our on-prem environment. So in this case, we could have a domain controller over here, and we definitely have our Active Directory. And we have various resources that we have over here. So all the identities that we have in this environment should actually be able to be accessed from our Azure environment using the Azure Active Directory.

3:01So this becomes very important as it allows our users to benefit from the various Azure services that they wouldn't actually be able to access had their only continued to run on prem. For example, SSPR, which simply allows our users to reset their passwords, this is a very important tool that users can actually leverage upon each and every time they've forgotten their passwords or they simply suspect something is happening and they want to reset their passwords, et cetera. This will give our users access to an Azure service to perform tasks that they previously couldn't complete without the help of an administrator.

3:32And this actually becomes a win-win situation as the user is now able to reset passwords to their own convenience without having to call the administrator. And the administrator, on the other hand, can now focus on more important tasks other than repeatedly resetting passwords for users. And for this kind of communication to actually happen in a secure way where [INAUDIBLE] are identities on the on-prem servers that we have are actually reflected in our Azure Active Directory, et cetera, we have to plan well. There are actually three ways in which we can accomplish that.

4:03And for us to be able to set that in place, we could opt to configure password hash synchronization within our environment. Another option we can make use of is the pass through authentication. There has to be the rightful type of authentication between these two environments in order for us to ensure that we can actually have all the identities reflecting within our Azure Active Directory. The third option that we can make use of is Federation. We are making use of Active Directory Federation services. I would like us to take some time and focus on each of these so that we can be able to make the best decision whenever we are planning for Azure Active Directory authentication.

4:41All right. So let us set some things straight over here. I would like us to think of these as two separate entities. As always, of course, these are two different parts. So we have our on-prem over here, OK? And there is our cloud. So everything beyond this line is just the cloud section. So let's look at these differently. The objective is for us to be able to connect whatever we have on-prem to the various services that we simply want to actually use within the cloud. This could be our applications, that could be Microsoft 365 services, or many other interesting Azure services, such as Azure Active Directory.

5:18All right. So for us to be able to link our on-prem environment to our Azure cloud environment, we have to make use of a tool that is known as the Azure Active Directory Connect or AD Connect. Now, before that, AD Connect was known as DirSync or directory synchronization. And I remember like yesterday when we used to create user accounts within our on-prem Active Directory. And users would go like, can I begin accessing my Microsoft 365 for Office 365 services? And be like, oh, give me a couple of minutes or five minutes. I'm still waiting for DirSync to complete synchronization.

5:48So this was actually what was required in order for us to have the various accounts that are actually stored on our on-prem to reflect within the various Azure and Microsoft 365 services that we're simply using. And prior to that-- actually Microsoft does this so many times with this issue of renaming services. This was also known as Azure Active Directory synchronization services. Now, the main point here is that we need to understand how AD Connect plays this important role in ensuring that there is a proper connectivity between our Active Directory on prem and the various services that we have in the cloud.

6:19So let's [INAUDIBLE] for example, that we'd like to authenticate the various identities that we have within our environment using password hash authentication. And in fact, this explains what exactly used to happen in the background each and every time I as an administrator was telling the various users whose accounts were just created to say they should wait a bit for DirSync to complete synchronization. Now what happens in the background is as follows. The first thing that you're going to do is to install your AD Connect on your domain controller. So you have that application running, and your domain controller on-prem has AD Connect installed.

6:52Once that has been done, the synchronization agent that runs in AD Connect is going to request for password hash values that are stored in your domain controller. And each and every tank this happens, the AD Connect is simply trying to query if there has been any update, if there has been any new identity whose password has to be updated to Azure Active Directory. So this happens each and every two minutes. This querying happens every two minutes. And then when the synchronization agent has run that request, your domain controller is going to do the second thing, which is to respond by retrieving those hash values.

7:27And please take note here that it isn't retrieving passwords in plain text. It's actually retrieving the hash value of each and every password. And once that hash value has been retrieved, it is going to sort it by adding additional characters and simply increasing its complexity. And once that hash value has been sorted, it is now going to respond by sending that hash value to the synchronization agent. So the synchronization agent now has the hash value that has been sorted and sent to each from the domain controller. The third thing is that the agent is going to decrypt this particular hash.

8:02Remember that this hash was actually sorted prior to it being sent to the agent. So what's going to happen is that the agent is going to remove every additional character that was added during sorting as to maintain the original state of the hash prior to it being sorted. So once it has been decrypted, then it will actually rehash it again. So when it's rehashes it, it will actually put it in the secure hash algorithm 256. And once it has done that, it's now going to pass it over securely using SSL to the Azure Active Directory database.

8:32So in this case, we simply want to ensure that the hash is stored in the Azure database. Now what is going to happen is that each and every time a user tries to access the Azure resources or any of these services from Microsoft 365, the Azure Active Directory database is going to have that hash as a condition with which is going to verify and authenticate users who require access to various Azure services. So in the event that the user keys in a password and that password's hash value is equivalent to the hash value stored within the Azure database, then that user will be granted access.

9:05In the event that this condition is not met or it's not true, then that user won't actually be granted access to any of those Azure services that require access to. So with PHS, or password hash authentication, you'd actually give your users the ability to use the same username and password that they'll use to sign into various resources that they have on-prem to sign into various resources that you now have in the cloud or in Azure. It is fairly easy to deploy as well and doesn't require any additional infrastructure for you to actually carry this out. As long as you're comfortable with storing all those password hash values in the cloud, then everything should actually be perfect for you.

9:38And in this case, you wouldn't actually require any additional or high-end functionalities in order for you to deploy it or even for your users to be able to work with it. It's actually a very easy type of authentication as you shall see in the coming skills when you get to configure this type of authentication. Now, if your organization isn't comfortable or their policies that negate your organization to directly synchronize your on-prem environment to your cloud services like Microsoft 365, well, Microsoft has a solution to that. You would actually use the Pass-through Authentication.

10:11Now, the Pass-through Authentication, unlike the password hash authentication, doesn't store all those values in the cloud. Users, in this case, are not authenticated by the hash value stored in the cloud rather they are authenticated by the very on-prem environment that they have using their domain controllers. So in this case, if we have whatever other services that you're running and we have a domain controller in this area, it will simply check what identities do we have within our Active Directory. All right, these are the identities. What are their passwords and their values? OK, these are their values.

10:43And thereby carry out authentication on-prem. So all of the authentication is going to happen on-prem unlike when we use password hash authentication. The caveat may arise when we have authentication issues to do with the service that we are using on-prem to authenticate our users. In this scenario, all we'll simply need is a lightweight agent installed on those domain controllers. If you have multiple domain controllers that we're using or it's a single domain controller, that would still function well. The advantage still is that you're not going to store any of those passwords in the cloud that would remain on prem for security reasons or any other reasons that your organization may simply have.

11:17Another option that could be ideal for your organization is when you're making use of a federated authentication system. So this would actually need to make use of your Active Directory Federation services. A Federation will usually have two or more domains that actually trust each other, and these domains have access to resources across the organization. So again, instead of any of those domains directly synchronizing to your cloud environment, you would simply want the authentication to happen on-prem. So you simply want to authenticate your user in a slightly similar manner to what you'd experience if you had passed through authentication.

11:51Now, federated authentication can be great, especially if you have multi-factor authentication that is being handled by different organizations. And you simply don't want that kind of authentication be done with maybe your Microsoft 365, and you want to maintain that organization. Then you could actually look no further but to implement this type of a solution. So while this may be great for organizations that simply want to authenticate their users on-prem and make use of certificates or third-party multi-factor authentication organization, this actually would require a lot of management. It will actually have a lot of overheads in terms of you maintaining the infrastructure that will be needed in order for you to make use of a federated authentication system.

12:30So in certain circumstances, you might end up having to deploy more than one authentication method. For example, you might want to have a part of what you'd see in the password hash authentication or maybe have another domain controller configured with Pass-through Authentication in order for you to benefit from the features that are contained in Pass-through Authentication. However, it is here that administrators will actually be able to decide what authentication method is the best for the environment. Well, for now, my friend, I hope this has been informative for you, and I would like to thank you for viewing.

0:00[OPENING JINGLE] Hello, and thank you for joining me in this Nugget, as we look at monitoring Azure AD Connect. Now we have so far looked at how we can install Azure AD Connect, and we understand its importance when it comes to managing our hybrid environment, especially when it comes to identities. Now, of course, when talking about hybrid environments, we are referring to both our cloud environment, as well as our own on-prem infrastructure, and what connects, or the links the two is our Azure AD Connect.

0:31So that is its key and important role. And we cannot just overlook such an important factor within our environment, without putting in place various solutions that will help us to keep an eye on what exactly is happening. And what are the things we could do to remain informed, in terms of how it's operating? How well it is synchronizing? And if at all, there is anything that we need to do to ensure that everything is running smoothly. All right. So what are those things that we can do within our environment to simply ensure that we have an understanding of what is going on with our Azure AD Connect? One of them is the Azure AD Connect Health Analytics.

1:01Now, this is a very important service by Microsoft, which simply gives us an overview in terms of how this tool is functioning within an environment, where there has been some errors and synchronization, where there's been any anomalies that are actually making these to not function properly. Now, this doesn't actually solve anything. It's not your troubleshooting tool that is going to give you step 1 to 10, on how you can resolve something, but it gives you insight in terms of what you can do. Although this may not be something that you'll be doing every day as an administrator, but whenever there is an issue that you're failing to understand, it is always important to look at what the real issue is by looking at all these alerts, which would help you in a troubleshooting process to resolve the problem.

1:41Another solution that we have to look at is the Event Viewer. As old as it may seem, this becomes very handy because, on that server where you're running your AD Connect, you can also have logs informing you when the device was turned off. Maybe there was an upgrade of your RAM on that server infrastructure or anything else that required the hardware to be turned off and AD Connect couldn't sync anymore. You would simply need to have an understanding of what exactly happened in the past and be able to track that and see if you could use some of that information that has been monitored previously to actually resolve any issues.

2:12Now without further ado, I want us to get into the Azure portal and look at how we can make use of the Azure AD Connect Health Analytics. And later on, look at the Event Viewer. See you there. All right, folks. So here we are within Microsoft 365 Admin Center and from the dashboard, we already can see that we have Azure AD Connect in place. So over here, we simply get an update in terms of our sync status, as well as password sync, et cetera. So if you would like to keep an eye to see that your Azure AD Connect is live, then this is one quick area you can always keep an eye on. But to have more information, then we can simply go and open our Azure portal.

2:45There are many ways to get there. And over here, I have Azure Active Directory. So I simply click over there. And once I am in here, then we can access our AAD again. And within our Azure Active Directory, we simply have to scroll down and access Azure AD Connect. So once we click on that one, we simply have more information here we have Troubleshoot. We have Refresh, et cetera. So this simply gives us an insight in terms of the health status of our Azure AD Connect. So we have quite a lot of information here from provision from Active Directory. We have managed Azure AD Cloud Sync, but our interest is mainly towards the end, where we have Health and Analytics.

3:21So if we click over here, this simply gives us information aligned with our own on-prem identity infrastructure and synchronization services to Azure. And in this case, identity is definitely referring to our users, et cetera. So let's go ahead and click over there. So over here, we have information regarding the latest features. We can add additional tools if we would like to have more information regarding AD Connect Health agents for Active Directory, et cetera. We can also provide feedback to Microsoft if we need to, or simply learn more about it too. And to our left-hand side, we have Sync Errors.

3:51And if we go and click over there, you'll notice that we can have more information regarding the various types of errors that could have actually been happening within the environment. And this is the area as an administrator, that could prove very helpful if you're carrying out some troubleshooting of our Azure AD Connect. For example, here, we have duplicate attribute. You may have a data mismatch, you have data validation failure, et cetera. And you could simply look at these and be able to carry out your troubleshooting based on any recorded errors in this section. Now the primary goal of this tool is to simply inform us when the last synchronization took place.

4:22And this is between our Azure Active Directory and our on-prem Active Directory. And it is important for us to make use of the various notifications that we can stay abreast of the situation. We would like to be informed each and every time there is something critical or an error of any sort that has stopped this synchronization. And if you look at the top section, we have Notification Settings. We click over there. We can actually enable this feature here. So that each and every time there is something critical, all our global administrators are informed that there is something that is going on.

4:53And they can receive emails, timely, informing them that there is normal synchronization going on, and the error is X,Y, Z. Now, this becomes very important as it allows us to see those errors as soon as synchronization stops, even if I was away from work, I would at least be in position to know what is going on and be able to begin resolving that error as soon as possible. So over here, we can simply go ahead and click on Save. And if you go back to the Azure Active Directory Connect Health, we can still benefit from other features. Over here under Configure, if we go and access our settings, we have a feature that allows us to always remain up to date with our Azure AD Connect Health agents.

5:30So by enabling this, we are simply ensuring that each and every time there's a new release of the Azure Active Directory Connect Health, would also be updated. And if it all we benefit as an organization from the various Microsoft services, when it comes to support, et cetera, and we simply want to give them access to our tenant's, then this can be very helpful. Turning these on would simply allow Microsoft Access to our tenants Health Data. So if that's something that I would like to have, then we can turn that on. Now, apart from working with Azure AD Connect Health to monitor and troubleshoot the various issues that could arise with the environment, it is important for us to also investigate what could be happening on the host, where AD Connect is installed.

6:05And based on my past experience, the most cases when AD Connect wouldn't synchronize, would be as a result of a power outage, where the host server had to switch from the primary source of power to the secondary one or in the event that there is a planned hardware upgrading that is to be done on the host server. Now for us to assert that, we need to make use of Event Viewer within our host server and be able to prove that. However, for the sake of your exam, it may be important for you to be aware of the various steps that you have to take in order for you to access the Azure Active Directory Connect health. Now here we are within our host server, Azure AD Connect in its integration with our cloud resources, does leave logs on a host server that we can use to have an understanding of what exactly could be happening within our environment.

6:45So if we search Event View over there, and would simply want to understand what exactly could be happening. We could use the Windows Logs feature. And over here, we can access applications. And from the applications area, we can do quite a number of things to simply read through and track those logs. For example, we can already see there is ADSync 405, and this is happening on the server. And if we wanted to, we could simply go and search. So in the search area, we could simply say AD Connect if we want. Or would simply say ADSync. And we can carry out that search to continue having more information that tells us what exactly has been happening on our device.

7:23Now over here, we can also see the level of these events that most of them are simply informational. But if we had something that was saying Error or Warning, then it would be something that really requires our attention. Apart from that, we can also see the debt and time on which this was happening. We can see the Source's Directory Synchronization, Event ID, et cetera. And we can also have more information regarding the various events that are being generated. From here, we have the general area and the details area, which could simply give us more information regarding this particular event. So all this have to do with our own on-prem Active Directory failing to synchronize with our Azure Active Directory.

7:55And if we simply wanted to get into details of all these, we could also try and make use of the future features over here. Filter Current Log, for example. Let's just deselect that and go straight to Filter Current Logs over here. And let's say we would like to see something that is Error-wise and Warning. So if you click OK, we'll have all that information displayed for us. And over here, we can see quite a lot of information regarding all this. Now, if we just go and select the Directory one, let's just select the first one. We can also begin picking up information regarding what has been happening. For example, Azure AD Connect scheduler is unable to start a new sync cycle since that particular day.

8:29And all these could be been informative for us. We would also look at the Errors if there is anything that is to do with AD Connect throwing errors at us. And fundamentally, anything that is hindering it from synchronizing within our environment would be very useful for us. So, my friend, this is how we can make use of the Azure AD Connect Health Analytics tool, as well as the Event Viewer to simply ensure that we are keeping an eye on Azure AD Connect. And that the synchronization is happening in time. So that our users who are working from various locations can access all our applications and everything that is within our Azure Active Directory.

9:03And our on-prem identities are updated in synchronizing to Azure and all the objects are synchronized by means of the Azure AD Connect. So in conclusion, these are the tools among many others that you may rely on to monitor your Azure AD Connect within your environment. For now, my friend, I hope this has been informative for you, and I would like to thank you for viewing.

0:00[AUDIO LOGO] Hello and thank you for joining me on this Nugget as we look at troubleshooting AzureAD Connect. Now each and every time we're looking at AzureAD Connect, we need to understand that this is an entity that is responsible for linking our on-prem services to AzureAD. And it is important for us to always ensure that the synchronization between these two environments are actually functioning well. Because the moment synchronization stops, then whatever we do on our on-prem, whether we are adding users or making certain edits, would actually not synchronize in AzureAD.

0:39In the previous Nugget, we looked at how we can go about keeping an eye on monitoring AzureAD Connect and look at the various important areas where that information could be found. However for this particular Nugget, I want us to take some time and look at what we can do in the event that AD Connect simply stops to synchronize or we simply keep on seeing errors and warnings, and we simply want to find a solution to permanently resolve that. I tell you the truth, there is nothing that is horrifying than coming to work every day and seeing that same ticket or that same error because you would know that, at a certain point, it is going to bomb and affect the rest of the infrastructure.

1:13So let us take some time and look at some of those areas that we can begin looking at in the event that we are troubleshooting AzureAD Connect. One of them is the Microsoft Services. Yes, the good old Microsoft Services is very key and important in helping us understand whether there is any service that is dependent on AzureAD Connect that isn't running. If any of those services are not running, you can simply go to the host server where AzureAD Connect is installed and check. Sometimes they could actually be running, but we simply have to restart them in order for them to be refreshed so that they can actually start anew and ensure that each and every service is running.

1:49This is one of the basic things we can do for those services. There are other times when you have to install those services anew, but that is something that is very serious. But if it actually becomes very important that we should go ahead and do that, we can run quite a number of scripts within PowerShell to install those services. Another aspect that we can also look at is the synchronization manager. Now the synchronization manager comes as part of the package when installing AzureAD Connect on the on-prem server. And in this case, there are other features that are actually contained in there, which you can tweak and fine tune to ensure that synchronization is happening.

2:24As the name suggests, this is simply the management of the synchronization between the two environments. And lastly, we have the AD Connect troubleshoot. Now this is something that would come embedded within AzureAD Connect itself. So we have to launch AzureAD Connect, and once we have launched it, we have the troubleshoot area. And there are quite a lot of features and options that we have to maybe select and ensure that we can also resolve that error based on the options provided and the trouble we are experiencing within our environment. And of course, we can still rely on some of the information that Microsoft provides, especially when it comes to all those tips that pop up within the health analytics area.

3:01We can also leverage on that information to ensure that we have as much information as we can to timely resolve any issue that may arise as a result of AzureAD Connect not syncing within an environment. Without further ado, I want us to dive into Microsoft 365 and look at how we can go about troubleshooting AzureAD Connect. All right folks, so here we are within the Microsoft 365 admin center. And if we go to the user management AzureAD Connect, already we can see sync status-- last seen 35 minutes ago.

3:32Now the AzureAD Connect feature that we actually rely on to ensure that everything is functioning properly is the Azure Synchronization Service Manager. This happens every 30 minutes automatically. Every 30 minutes an update has to take place. Now this is a synchronization update. So if, for example, I'm adding a user over here in this area-- if that user is added, when that synchronization takes place, then that information must be transferred from our on-prem environment to our Azure environment. Now it doesn't necessarily take 30 minutes for a single user that we are creating on on-prem AD to be updated to AzureAD.

4:09However, this synchronization is specified for 30 minutes to ensure that if there is anything-- any user, any object, or anything that has been done on our on-prem infrastructure-- then all of those configurations and updates that have been done can synchronize and be updated into our cloud environment. Therefore, this is very important in ensuring that at the time of this synchronization every piece of data or object we configure on our on-prem server can now be integrated and updated into Azure. And each and every user who needs to make use of that service from the cloud would now be able to access it without having any difficulties.

4:43And you can actually look into Synchronization Manager and look at how you can go about manually updating this, if you have issues that have to do with users who are not able to access their resources or are not able to sign into their Azure tenant, or they're simply having challenges accessing these services. But in the event that doesn't happen automatically, like I said previously, we can come over here and manually restart that service. So here, we are already notified that this service hasn't been able to sync in that past time.

5:15And if we head to our Azure Active Directory, so that we can access the AzureAD Health Analytics, you'll also be able to see that there is information already informing us that something isn't right. So here we are within AzureAD. If we access our AzureAD Connect over here and access the Health Analytics, you'll be able to see that-- over here-- if you've go to sync errors-- OK, we don't really have anything in the error section. How about sync services? Oops, there we go. All right, so over here we can see that this is the service name that is affected and we can see that there are two active alerts-- the time when this happened-- and this is simply a warning that there is an unhealthy service of some sort.

5:55There we go. There's a warning over there. If we have to resolve that, we have to pick the bits and pieces together and begin looking at what we can do in order for us to resolve that. So we can see over here there are also two counts there. And we can actually expand that over here with health service data is not up to date. All right, so that is one warning. And we have synchronization has stopped. Now I have said it in the previous Nugget, in most cases this could actually be as a result of maybe a power outage. The server is simply off.

6:25But as you can see from the Microsoft 365 AD Connect area, password synchronization is happening. It's just the syncing status that is telling us that something isn't right. So already this nullifies that this could be a power-related issue. Or maybe there was some outage of some sort that rendered your server to completely go off. So over here we can also see that, if we click over there, we can get more information regarding what we can do. There are also additional links that we can click on to simply ensure that we understand and can troubleshoot that issue correctly. If we go back there, we can also do the same over here.

6:56Now sometimes, due to regulatory stipulations, that prevents organizations from collecting AD Connect health information or we could simply have this service off within our environment. And if we head back to the Azure Active Directory Sync area and check the other alert that we have here, this one is an error type and it's actually a synchronization-related error. There isn't any communication anymore that is happening between our on-prem server and our Azure Active Directory. And this shows us that the scope is covering that account and was raised on that particular date.

7:28And then we have all the information, et cetera. And if we click on it over here, we can also now have detailed information regarding this particular alert. We can see what the issue is. It's a synchronization-related issue and we are unable to update this information or the data in AzureAD-- over there-- and we have a suggested fix. Over here we're notified that AzureAD Connect may fail to schedule its next sync if AzureAD is actually open in the background. And we may simply have to ensure that it is closed in order for it to schedule the following synchronization. We may also have other features that would simply allow us to make use of all the available tools on our Windows devices to ensure that this service is running properly.

8:06Over here we can see that we have services and we can go and restart all the services that have something to do with the Microsoft AzureAD sync. However, when we do this we have be very careful, as resetting this will interrupt any other service that depends on the Microsoft AzureAD sync-- right there. Also additional links that we can follow over here. There is quite a lot that we can rely on as we continue hunting for the solutions that have to do with us resolving the errors that we are experiencing within our environment. All right so the low hanging fruit for us, when troubleshooting this error is to begin with services.

8:39If we go and check services, or you could simply say run and you do services with MSC, then you should be able to have a view into what exactly could be happening within your environment. We would be, in our scenario, looking for anything that is to do with AzureAD Connect. We can see here, AzureAD Connect AD DS Insight Services is running. We have the Health AD DS Diagnostic Services. We have quite a lot of them that have to do with AzureAD Connect so we could manually go and maybe try to do a restart of each one of them, or simply stop them and start them afresh.

9:13However if there are a lot like this, the quickest way in which we could go about that is to simply go and open up PowerShell. And over here, we could go and do a restart service. And then we can specify that anything that has to do with AzureAD Connect within our environment should actually be restarted. Simply add an asterisk over here so that everything that has that at its end can simply be restarted. Press enter over there and it will restart those services within our environment. Let's just see there. OK, those are warnings to say restarting this would actually have some implications on any other service that depends on AzureAD Connect.

9:52They should actually go off, all of them. And later on be restarted. That on its own should help us to refresh or correct any other errors that pertain to this problem that we are facing within our environment. And if that in any instance does not work or doesn't resolve our scenario, then would have to escalate this and look at how best we could look at other features and tools that could help us resolve this particular error. All right, so another tool that we can rely on is the Azure Active Directory Connect Synchronization Service Manager.

10:25Over here we have Synchronization Service. If we click over there to open it we have in this area the names, the profile, and the status, including the time and end time of all the synchronization that actually took place. Over here, we can simply have an insight into any sync that wasn't successful-- if at all there was any. And if you'd like to do a manual synchronization, we could use our connectors in this area-- if we click on connectors over there. And from here, you can see the two domains that we have-- the M365 domain and the junction technology domain.

10:55And if we needed to actually go ahead and do a manual synchronization of any of these domains, we can simply click on the domain and we have connectors in here-- or we can simply right click on that-- and do a restart of this. We could either stop it and try to run it or if we are having trouble maybe synchronizing certain objects within our environment, then we can go and select the properties area. Let's go and click on properties over here. And we have the connector designer in this section and the various menus. And here we have select object types.

11:26If we click over there, we have to ensure that the feature that you're looking for, for instance, is a group that is in synchronizing, then we'll have to verify whether group is selected. Now by de-selecting this option, you understand that the replication would be in the synchronization process. It will not include these deselected feature. And there are other features that may not appear over here. If in case we wanted to see that we can simply go to select all over there and we can view the various features that we may simply want to add in this particular domain. Now all this becomes very important because, in the synchronization process, anything that is not included and may be useful for users, in the event that they try to access it from the cloud that feature won't actually be there.

12:06All right, so other than the Synchronization Service Manager, we also can go to AD Connect itself. And when we open AD Connect there is a feature that allows us to begin the troubleshooting process. I'm just reposition this for us. All right, so there we go. Now if you notice here, we have the configure area-- just at the bottom here. If we go and click on configure, at the very bottom of the tasks that we have in here we have troubleshoot. Go and click on troubleshoot over there and click next. And once we have done that, we can launch the troubleshooting tool. And right away it'll open PowerShell with a number of options.

12:40Over here we have options from one until six and Q is for us to quit and go out of this particular area. And we have the first one, where we simply want to troubleshoot an object synchronization. So take, for example, that you created a group and that group after-- let's say an hour or two-- it isn't still popping up within Azure. You can actually begin to look at what could be causing that group from not showing within the cloud environment. That would simply help you to begin troubleshooting of such particular objects.

13:11You also have troubleshooting password hash synchronization for identities that aren't going to be able to synchronize. You have collecting general diagnostics information. Configure AzureAD DS Connect to account permissions. You have test AzureAD connectivity. You have test active directory connectivity. All these could be very helpful. And if you're thinking in our scenario we are actually unable to connect, this will become very important. The fifth option-- just for us to begin testing for connectivity issues and also verify that our active directory is perfectly connected.

13:43All right, so let us start with the first one, which is the fifth one, when we are testing active directory connectivity. Let's go ahead and select five over there. When you press five, it should run a test. It says we're testing Azure connectivity for connector M365. That's our domain, right? And then it actually gives us a printout here of true and no connectivity issues have been detected. This looks good on this end. All right, so how about our active directory connectivity? Let's go ahead and select option number six over there.

14:14If we select option number six and press enter? OK, it says current configuration status. Would you like to test a forest that already has a connector configured? Oh yes, we would like to. We have junction technology, right? So if we press A over there and press enter-- configured active directory connectors-- we have one over there, which is junction technology. That's the name. Let's just go ahead and specify junction technology. All right, .co.za and press enter. If there are any issues with this-- you can see that already it is picking up that information to do with our FQDN and all the data that is required.

14:45And finally, it gives a printout output of no connectivity issues detected. So far everything looks good, but we can also still make use of various options in here, depending on the scenario we are trying to resolve. If you are dealing with an identity issue or if you are dealing with an object issue, we could also rely on these options over here. So how about object synchronization, option number one? Let's try that out and see how it turns out. If you press enter over there, that simply gives you access to your active directory objects within that domain.

15:16Now in this case, your object could be users, or they could be shared folders or applications-- whatever it is-- if that isn't syncing, then you can simply specify the name of that object over here. And once you have specified the name of the object over there, then you can initialize the synchronization for that particular object. Now there are times when certain objects are not accessible because of the privileges or the role that a particular administrator has within the environment. So if there is need for you to maybe key in some admin credentials, then you have to key in those admin credentials prior to you synchronizing those objects.

15:48For now, I want us to head back to Microsoft 365 and look at whether our AD Connect has been resolved by the various troubleshooting tools that we have implemented so far. All right, so here we are within Microsoft 365 Admin Center and this is our AzureAD Connect new status over here. I simply had to give it a bit of time in order for it to complete the synchronization. And ensure that at the moment you are doing this, your AzureAD Connect on your host server should be turned off. There shouldn't be anything that is actually running or any other service that is still having its application open in the taskbar, et cetera.

16:21There we have it. Now in conclusion, let us look at the things that we consider are vital when we are troubleshooting our AzureAD Connect within our environment. Now we spoke earlier of the role that the Microsoft Services plays in restarting and re-initializing the various services that are running that have to do with AzureAD Connect synchronization in the environment. Therefore it is important for us to keep an eye on this feature. But the moment we actually realize that there's something wrong with the synchronization or the monitoring of the various services that we have to ensure that everything is running smoothly.

16:52And once we have verified that and made sure that nothing really isn't stuck in this area, then we can begin looking at the tools that are provided by the Synchronization Service Management. Now in this area we have seen how we can use the connectors to restart and stop the various domains that we have to simply aid the configuration. And if at all there is something that we suspect could have happened in the background, we can use the features that are contained within here to manually start synchronization. And finally, we looked at the various PowerShell scripts and options that are provided within the AD Connect troubleshooting tool that we've actually seen, we could use to troubleshoot objects, to troubleshoot synchronization, to also verify that we have connectivity to an active directory.

17:32With this, my friend, I hope this has been informative for you and I would like to thank you for viewing.