Saturday, April 23, 2016

Password Sync as a Temporary Fall-Back from Federated authentication in Office 365

Authentication is a fundamental part of Office 365. Office 365 and ADFS hybrid deployment scenario with High-Availability (especially with Geo redundancy properties) requires significant deployment effort, resources and etc. In most cases this is not a problem for a large Office 365 customers who have few data-centers, resources to deploy Azure IaaS and ADFS farm there.

Scenario:
The role of ADFS farm is critical in a single site deployment for Small to Middle sized Office 365 customers.
You may have multiple reasons why ADFS farm can be disconnected from Office 365:
- on-premises data-center Internet connection is down
- internal server maintenance that had impact on ADFS servers
- internal network maintenance that had impact on ADFS servers
- expired digital certificate
- etc...

If you cannot pass through federated authentication in services like Exchange Online, Skype for Business Online (which can have PSTN Calling functions enabled with E5) and etc. then you cannot do your business as well.

Solution:
With such ADFS downtime scenarios one of the options to recover authentication is to switch temporarily from Federated to Synchronized Password Authentication. You should implement "Password synchronization" with AAD Connect sync prior you have outage to the AD FS infrastructure. It has no impact on existing Federated authentication.

Temporarily “Switch” from Federated Authentication to Synchronized Password is not automatic option and requires manual configuration. Federated authentication can be changed to synchronized password authentication on a per-domain basis in the event of an outage to the AD FS infrastructure.
  • Run the Windows Azure Active Directory Module for Windows PowerShell as an Administrator 
  • Run the following commands from the primary AD FS server:
$Cred = Get-Credential

Connect-MsolService –Credential $Cred
Convert-MsolDomainToStandard –DomainName <federated domain name> -SkipUserConversion $true -PasswordFile C:\Temp\passwordfile.txt

# Once the outage is over use the following command to convert the domain back to federated:
Convert-MsolDomainToFederated –DomainName <federated domain name> -SupportMultipleDomains

It is recommended that you do not change UserPrincipalNames or ImmutableIds after converting your domain to the managed state for users that have been switched to use synchronized passwords.

It is worth noting that switching between Federated Authentication and Synchronized Password Authentication for sign in to Office 365 is not instant and will likely interrupt service access. This may not be a factor in the initial activation (as it’s likely an outage scenario) however it is something to bear in mind when cutting services back to Federated Authentication.

21 comments:

  1. Having read this I thought it was very enlightening. I appreciate you taking the time and effort to put this content together. I once again find myself spending way too much time both reading and commenting for KBC Lottery Number Check. But so what, it was still worthwhile!

    ReplyDelete
  2. Hi buddies, it is great written piece entirely defined, continue the good work constantly.

    Data Science Course

    ReplyDelete
  3. It is extremely nice to see the greatest details presented in an easy and understanding manner.

    Data Science Training

    ReplyDelete
  4. Great advice and very easy to understand. It will definitely come in handy when I get the chance to start my blog.

    360DigiTMG Data Science Courses

    ReplyDelete
  5. This is an excellent article. Thanks for sharing this information. I will be visiting your blog regularly for the latest articles. I will be visiting your blog regularly to see some of the latest posts.

    360DigiTMG Data Science Certification

    ReplyDelete
  6. Just a shine from you here. I have never expected anything less from you and you have not disappointed me at all. I guess you will continue the quality work.

    Business Analytics Course in Bangalore

    ReplyDelete
  7. Interesting post. I wondered about this issue, so thanks for posting. A very good article. This is a really very nice and useful article. Thank you

    Data Analytics Course in Bangalore

    ReplyDelete
  8. Fantastic blog extremely good well enjoyed with the incredible informative content which surely activates the learners to gain the enough knowledge. Which in turn makes the readers to explore themselves and involve deeply in to the subject. Wish you to dispatch the similar content successively in future as well.

    artificial intelligence certification in bhilai

    ReplyDelete
  9. Impressive blog to be honest definitely this post will inspire many more upcoming aspirants. Eventually, this makes the participants to experience and innovate themselves through knowledge wise by visiting this kind of a blog. Once again excellent job keep inspiring with your cool stuff.

    Data Science training

    ReplyDelete
  10. Extraordinary blog went amazed with the content that they have developed in a very descriptive manner. This type of content surely ensures the participants to explore themselves. Hope you deliver the same near the future as well. Gratitude to the blogger for the efforts.

    Digital Marketing training

    ReplyDelete
  11. Great article with top quality information, found very helpful thanks for sharing waiting for next blog update.
    Ethical Hacking Course in Bangalore

    ReplyDelete
  12. It took a while to understand all the comments, but I really enjoyed the article. It turned out to be really helpful for me and I'm positive for all the reviewers here! It's always nice to be able to not only be informed, I'm sure you enjoyed writing this article.
    Cyber Security Course in Bangalore

    ReplyDelete
  13. Happy to chat on your blog, I feel like I can't wait to read more reliable posts and think we all want to thank many blog posts to share with us.
    Cyber Security Training in Bangalore

    ReplyDelete
  14. Top quality blog with very informative information found very useful thanks for sharing.
    Data Analytics Course Online

    ReplyDelete
  15. Fantastic blog extremely good well enjoyed with the incredible informative content which surely activates the learners to gain the enough knowledge. Which in turn makes the readers to explore themselves and involve deeply in to the subject. Wish you to dispatch the similar content successively in future as well.

    artificial intelligence certification in bhilai

    ReplyDelete
  16. Tremendous blog quite easy to grasp the subject since the content is very simple to understand. Obviously, this helps the participants to engage themselves in to the subject without much difficulty. Hope you further educate the readers in the same manner and keep sharing the content as always you do.

    Data Science Course in Bhilai

    ReplyDelete
  17. Truly incredible blog found to be very impressive due to which the learners who ever go through it will try to explore themselves with the content to develop the skills to an extreme level. Eventually, thanking the blogger to come up with such an phenomenal content. Hope you aarrive with the similar content in future as well.

    Digital Marketing Course

    ReplyDelete