Easy Azure AD Connect Configuration of Hybrid Azure AD Join Plus External SQL with gMSA Accounts
I'm getting ready to replace an Azure AD Connect synchronization server at work that is running the local SQL Express instance with a new AAD Connect sync server using an external full SQL instance. Remember that SQL Express has a 10GB limit and we are not quite there yet. But, we have not enabled Hybrid Azure AD Join yet. This will tip us over for sure. Plus we want Hybrid Azure AD Join to allow us to utilize conditional access based on trusted devices. Yes this is a lot on the go here. Plus we use gMSA accounts to run SQL and AAD Connect services. This video manages to tick most of the tick boxes.
Make a couple of Group Managed Service Accounts for the Scenario
New-ADServiceAccount s_TUS-SQL1 -DNSHostName s_TUS-SQL1.aaco.local -KerberosEncryptionType RC4, AES128, AES256 -PrincipalsAllowedToRetrieveManagedPassword TUS-SQL1$ -SamAccountName s_TUS-SQL1 -ServicePrincipalNames http/s_TUS-SQL1.aaco.local/aaco.local, http/s_TUS-SQL1.aaco.local/aaco, http/s_TUS-SQL1/aaco.local, http/s_TUS-SQL1/aaco
New-ADServiceAccount s_TUS-SYNC1 -DNSHostName s_TUS-SYNC1.aaco.local -KerberosEncryptionType RC4, AES128, AES256 -PrincipalsAllowedToRetrieveManagedPassword TUS-SYNC1$ -SamAccountName s_TUS-SYNC1 -ServicePrincipalNames http/s_TUS-SYNC1.aaco.local/aaco.local, http/s_TUS-SYNC1.aaco.local/aaco, http/s_TUS-SYNC1/aaco.local, http/s_TUS-SYNC1/aaco
Watch the video:
How to Use Group Managed Service Accounts Step by Step
• How to Use Group Managed Service Acco...
AAD Connect Playlist
• Entra Connect (Azure AD Connect) Play...
Other references
Can't delete user objects synced from AD
https://support.microsoft.com/en-us/h...
Windows Firewall and SQL
https://docs.microsoft.com/en-us/sql/...