Install and configure Azure AD Connect

Installing Azure AD Connect on the domain controller is supported, but Microsoft doesn’t recommend that. It’s best to install Azure AD Connect on a separate domain-joined Windows Server. In this example, we will use the domain controller for demonstration purposes.

Note: Do not install additional software or roles on Domain Controllers.

To install Azure AD Connect, follow the below steps:

1. After downloading Azure AD Connect, run the setup. Agree to the license terms and click Continue.

2. Click on Customize for a custom install. It will give you all the options which you can decide for yourself.

3. Click Install to start the Azure AD Connect synchronization service installation.

4. Select Password Hash Synchronisation. Click Next.

5. Enter the Azure AD global administrator credentials. Click Next.

6. Click on Add Directory.

7. Select Create new AD account. Fill in the administrator account with Enterprise Admin rights. Click OK. Azure AD Connect will create an AD DS Connector account (MSOL_xxxxxxxxxx) in AD with all the necessary permissions.

Note: You can select the option Use existing AD account and type the AD account credentials you created.

8. The Active Directory is added. Click Next.

9. Select Continue without matching all UPN suffixes to verified domains. Click Next.

10. You can sync all domains and OUs. Click Next.

In our example, we will only sync the Company OU and sub-OUs.

11. Select how users should be identified in your on-premises directories and select how users should be identified with Azure AD. Click Next.

In our example, we will keep the default settings.

12. Synchronize all users and devices. Click Next.

13. Select Exchange hybrid deployment. Click Next.

You can enable password writeback. After that, enable Self-Service Password Reset in Azure AD. You can do that step later if you want.

14. Select Start the synchronization process when configuration completes. Click Install.

15. Azure AD Connect configuration completed. Click Exit.

After installing Azure AD Connect

Sign in to the Microsoft 365 admin center, and you can see that a new user is displayed. That’s the Azure AD connector account created by Azure AD Connect setup, which will sync AD objects between on-premises AD and Azure AD.

Note: Azure AD Connect setup creates a total of three service accounts.

• Click the start menu on the Windows Server. Search and start the application Synchronisation Service. It already did start a synchronization: the first time a full import is made, a full synchronization, and an export.
• Click on the domain.onmicrosoft.com with the profile name Export. Click on Adds in the Export Statistics.

These objects are exported with success from on-premises AD to Azure AD. You can double-click on each Distinguided Name to identify the user object.

Refresh the Microsoft 365 admin center and verify the users.

Everything looks great. We did successfully install and configure Azure AD Connect.