Any application you use should be used in accordance with best practices, especially those that interact with Active Directory and Azure AD, the lifeblood of your IT ecosystem. The most important ones to remember when utilizing Azure AD Connect are listed below.
As a domain controller, defend the server.
Protect the Azure AD Connect server as though it were a domain controller. Limit the accounts that can log in interactively, the accounts that have local administrator permissions, and the physical access to the server. Along with closely adhering to established practices for password complexity and expiration, ensure sure the tool’s service account has only the rights it requires.
Pay special attention to who has access to the tool.
The person who installed the sync engine and local admins on the computer where it runs are the only individuals who may use and administer it by default. Add additional users to the ADSyncAdmins group on the local server to grant them access to the tool. However, considering the effectiveness of the instrument, it’s imperative to use caution when enlarging this group.
Choose your groups for Azure AD synchronization with care.
The default configuration will sync all user and group objects from your on-premises AD to Azure AD (apart from those mentioned above). However, not every on-premises group you have will be genuinely helpful in the cloud. (In reality, many of them might even have outlived their usefulness on-premises; group sprawl is a typical issue and routine group cleanup is beneficial for both productivity and security reasons.)
Examining all of your on-premises groups critically is the best synchronization practice. Remember that there are two fundamental categories of AD groups: distribution groups, which streamline communications addressing, and security groups, which serve as the trustee for securing an object like a file share or SharePoint list (primarily email). After that, use the sync engine’s filtering functionality to remove any groups that are unrelated to your cloud environment.
Remember to momentarily disable the scheduled sync process before you begin modifying the filtering so that your changes don’t take effect before you have had a chance to confirm that they are right.
Avoid syncing on-premises admin groups with Azure AD in particular.
The on-premises directory can be managed thanks to admin groups for on-premises systems, including Domain Admins. There is no advantage to synchronizing these groups to Azure AD. A user in Azure AD can see the membership of the (useless) admin group and know exactly which on-premises accounts to target with phishing or other attacks because those groups will be exposed to more prying eyes. However, this does introduce unnecessary risk because those groups will be exposed to more prying eyes. Use the filtering feature to make sure that all admin groups aren’t synced, as a result.
Use the capabilities of Azure AD to manage Azure AD instead.
Create the proper cloud-only administrators for managing Azure AD using the predefined roles, such as Global Administrator, Application Administrator, Compliance Administrator, and SharePoint Administrator. It’s important to keep in mind that a Global Administrator has the ability to change any administrative configuration in your Azure AD organization. For this reason, Microsoft advises giving this job to no more than five persons in your business. Utilize Microsoft’s capabilities like privileged identity management and multifactor authentication (MFA) to further secure accounts that have been given administrator privileges (PIM).
The hybrid groups from your on-premises AD that you select to sync up are just the beginning as far as groups are concerned. In addition to security groups and distribution groups, you may now build Microsoft 365 groups as cloud-only groups. In addition to serving as a distribution list and a data repository supported by shared mailboxes and SharePoint, a Microsoft 365 group can secure objects similarly to how a security group can. Additionally, every team in Microsoft Teams makes advantage of Microsoft 365 groups. Watch out for group sprawl both on-site and in the cloud, and take steps to clear it up.
Professional Labs is the Best Cloud Managed Services Provider in Saudi Arabia, for more details contact
Contact Us | Professional labs (prolabsit.com)
