Add Second Domain to AD and Sync with Azure AD for Scalable Identity Management

Adding a second domain to your Active Directory (AD) and syncing it with Azure AD is a great way to scale your identity management. This process allows you to manage multiple domains from a single location.

To start, you'll need to prepare your AD environment by installing the Azure AD Connect tool. This tool is used to synchronize user accounts between your AD and Azure AD.

The Azure AD Connect tool is available for download from the Microsoft website. It's a free tool that's easy to install and configure.

With the Azure AD Connect tool installed, you'll need to create a new Azure AD tenant to sync with your AD domain. This will give you a separate identity management system for your second domain.

To add a new domain, you'll need to use the New-MgDomainFederationConfiguration cmdlet in PowerShell. This cmdlet is used to add a new domain to Microsoft Entra ID and configure the federation settings.

Curious to learn more? Check out: Azure Active Directory New Name

First, you'll need to install the Azure AD PowerShell module on a machine. Then, run the command $cred=Get-Credential to enter the username and password of a Hybrid Identity Administrator for the Microsoft Entra domain you're federating with.

Next, run the command Connect-Entra -Scopes 'Domain.ReadWrite.All' to connect to Microsoft Entra ID. After that, run the command New-MgDomainFederationConfiguration –SupportMultipleDomain –DomainName to add the new domain.

The –SupportMultipleDomain parameter is used to configure the IssuerUri so that it's based on the name of the domain. This parameter makes Microsoft Entra ID configure the IssuerUri so that it's unique across directories.

Here's a step-by-step guide to adding a new domain:

1. Run the command $cred=Get-Credential to enter the username and password of a Hybrid Identity Administrator.

2. Run the command Connect-Entra -Scopes 'Domain.ReadWrite.All' to connect to Microsoft Entra ID.

3. Run the command New-MgDomainFederationConfiguration –SupportMultipleDomain –DomainName to add the new domain.

By using the –SupportMultipleDomain parameter, you'll be able to add the new domain and configure the federation settings correctly. This will ensure that the IssuerUri is unique across directories and that authentication to Microsoft Entra ID or Microsoft 365 succeeds.

You might enjoy: Hybrid Ad Azure

To add a second domain to Azure AD, you'll need to create a new Azure AD tenant, which is a separate directory for your second domain. This is necessary to keep the two domains separate and secure.

The process of adding a second domain to Azure AD involves creating a new Azure AD tenant, which can be done by going to the Azure portal and clicking on the "Create a resource" button.

You can also use the Azure AD admin portal to create a new tenant, which is a more straightforward process. This involves entering some basic information about your organization and creating a new tenant.

To sync the second domain with Azure AD, you'll need to create a new Azure AD connect sync configuration. This involves installing the Azure AD connect agent on a server in your second domain.

The Azure AD connect agent will then sync the users and groups from your second domain with the Azure AD tenant. This process can take some time, depending on the number of users and groups in your domain.

Make sure to follow the steps outlined in the Azure AD connect documentation to ensure a smooth sync process.

Discover more: Azure File Sync Agent

To sync your AD changes with Office 365, you have two options. You can either ensure your changes are replicated to all domain controllers before triggering an Azure AD Connect synchronization, or make the changes directly on the domain controller used by Azure AD Connect.

Using the RepAdmin command available in the AD tools can help ensure your changes are replicated to all domain controllers. This involves running two commands for every DC to ensure both pull and push synchronization is made.

Making the changes directly on the domain controller used by Azure AD Connect is a better solution, as synchronizing all DC's can be a bit tedious.

If you're running Easy365Manager, the Azure AD Connect synchronization is available in both user and group properties, making it a simple one-click operation.

If you don't have Easy365Manager, you'll need to manually connect with PowerShell to your Azure AD Connect server and run the following command.

Explore further: Azure Domain Controller