Changing the User Source of Authority from AD to Entra ID

Key Concepts

• Source of Authority: The primary system where user identity information is managed and originates.
• Active Directory (AD): On-premises directory service for managing users, computers, and other resources.
• Entra ID (formerly Azure AD): Cloud-based identity and access management service.
• Entra Connect Sync: On-premises synchronization engine for syncing AD objects to Entra ID.
• Entra Cloud Sync: Cloud-based synchronization engine for syncing AD objects to Entra ID, with a lightweight agent on-premises.
• isCloudManaged Attribute: An Entra ID attribute indicating whether a user object is managed in the cloud (true) or synchronized from on-premises (false).
• onPremisesSyncEnabled Attribute: An Entra ID attribute indicating if on-premises synchronization is enabled for a user.
• Cloud Kerberos Trust: A trust relationship established between Entra ID and on-premises AD, enabling passwordless access to Kerberos-based resources.
• Passwordless Authentication: Authentication methods that do not require a traditional password, such as Windows Hello for Business, FIDO2 security keys, or certificate-based authentication.
• User Write-back: The ability to synchronize changes made to user objects in Entra ID back to on-premises AD. (Currently not supported for this feature).

Shifting User Source of Authority from Active Directory to Entra ID

This video details the process and implications of changing the source of authority for user accounts from on-premises Active Directory (AD) to cloud-based Entra ID. This shift is driven by the increasing reliance on cloud services and the desire to leverage Entra ID's advanced governance, security, and lifecycle management capabilities.

Current State: AD as Source of Authority

• Traditionally, user accounts originate in on-premises AD.
• These user objects are then synchronized to Entra ID using tools like Entra Connect Sync or Entra Cloud Sync.
• In this configuration, the Entra ID user object is marked as not cloud-managed (isCloudManaged attribute set to false) and on-premises synchronization is enabled (onPremisesSyncEnabled attribute set to true).
• This means that direct editing of most attributes on the Entra ID user object is restricted, as changes must be made in AD and then synchronized.
• Example: The video demonstrates this by showing that Barry Allen's user properties in the Entra ID portal are grayed out, indicating they cannot be edited directly. A Graph API query confirms isCloudManaged is false.
• Implication: This limits the ability to utilize cloud-native features like HR-driven provisioning directly to Entra ID or leverage advanced lifecycle management. Changes must flow through AD, creating a dependency.

The Shift to Entra ID as Source of Authority

• Motivation: Organizations are moving their identity source of truth to the cloud (Entra ID) to benefit from cloud-based authentication protocols (OpenID Connect, OAuth, SAML), enhanced security, governance, and lifecycle management, while reducing reliance on on-premises technologies like Kerberos.
• Goal: To make Entra ID the primary management point for user identities, allowing direct provisioning from HR systems and enabling full utilization of Entra ID features.
• Key Change: The isCloudManaged attribute for a user object is changed from false to true.

Prerequisites and Considerations for Shifting Authority

• No User Write-back: A critical point is that there is no user write-back functionality with this feature. Changes made to a user object in Entra ID after the source of authority is shifted will not be synchronized back to on-premises AD. The two systems become disconnected for user object management.
• HR System Integration: The HR system must be configured to provision users directly to Entra ID.
• On-Premises AD Cleanup: If users are no longer managed in AD, consider moving them to a specific Organizational Unit (OU) to avoid accidental bulk changes or deletions.
• Exchange Hybrid Mode: All mailboxes must be migrated to Exchange Online; Exchange hybrid mode is not supported.
• Accessing On-Premises Kerberos Resources:
  • If an organization still relies on Kerberos-based resources (e.g., file shares), access is still possible after shifting the source of authority to Entra ID.
  • This requires establishing a Cloud Kerberos Trust.
  • Users must use passwordless authentication (e.g., Windows Hello for Business, FIDO2, certificate-based authentication).
  • When a user authenticates passwordlessly on an Entra ID joined or hybrid joined device, Entra ID establishes a Cloud Kerberos Trust.
  • Entra ID acts as a pseudo read-only domain controller object in AD.
  • The passwordless authentication process generates a primary refresh token and a partial Ticket Granting Ticket (TGT).
  • This partial TGT is presented to an on-premises domain controller, which issues a full TGT.
  • The full TGT is then used to obtain a service ticket for the specific Kerberos resource.
  • Example: This enables access to resources like Azure Files, Azure Virtual Desktop, or web apps using App Proxy, even if the user's source of authority is Entra ID.

Step-by-Step Process for Changing Source of Authority

1. Prerequisites: Ensure all prerequisites are met (e.g., HR provisioning to Entra ID, mailboxes in Exchange Online, consent for on-premises sync behavior).
2. Modify isCloudManaged Attribute:
   • This is typically done via scripting or API calls.
   • The video demonstrates using the Microsoft Graph API.
   • A PATCH request is made to the user object.
   • The request body updates the isCloudManaged attribute from false to true.
   • Example: The video shows a Graph API call to change isCloudManaged to true.
3. Synchronization Behavior:
   • Once isCloudManaged is set to true, both Entra Connect Sync and Entra Cloud Sync will block synchronization for that user object from AD to Entra ID.
   • If using custom solutions like Microsoft Identity Manager (MIM), ensure exclusions are configured to prevent synchronization of these objects.
4. Verification:
   • Entra ID Portal: Refresh the user's profile. The "On-premises synchronization" status should change to "No," and the edit properties should no longer be grayed out.
   • Graph API: Perform a GET request on the user object to confirm isCloudManaged is now true.
   • Audit Logs: Check Entra ID audit logs for the "Change source of authority" activity to track the modification.

Post-Change Actions and Choices

After successfully changing the source of authority for a user:

1. Disable and Delete On-Premises AD Account: In most scenarios, the on-premises AD user account is no longer needed. It is recommended to:
   • First, disable the AD account to ensure no unintended access or impact.
   • After confirming stability, delete the AD account.
2. Maintain On-Premises AD Account (for Kerberos Access): If Kerberos-based resources are still required, the on-premises AD account can be retained, but it will not be synchronized. Access to these resources will rely on the established Cloud Kerberos Trust and passwordless authentication.

Recommendations and Conclusion

• Group Source of Authority First: It is strongly recommended to change the source of authority for groups before changing it for users.
• Documentation: Refer to the official Microsoft documentation for detailed prerequisites and guidance.
• Planning and Testing: This change has significant implications. Thorough planning and testing in a non-production environment are crucial.
• Strategic Shift: As organizations increasingly adopt cloud-first strategies, shifting the identity source of truth from AD to Entra ID is a natural progression to leverage the full suite of cloud identity and security capabilities. This includes managing users, groups, and other identity-related objects in Entra ID.