Two AD Domains to one O365 tenant?

chilemoore
chilemoore used Ask the Experts™
on
I have an interesting scenario.  From what I have read it's not possible but I wanted to see if anyone has a workaround.  I am an educational institution.  We have a two separate Staff and Student networks that include AD services.  We Share One O365 tenant but have a student (studentname@student.school.edu) domain and a staff (staffname@school.edu) domain .  We currently use AD Sync for staff accounts.  Is it possible to add ADSync in my student AD and sync to the tenant but only syncing to the student accounts?  Currently our Staff ADSync only syncs staff accounts (staffname@school.edu).   Reason is I'm trying to improve login process and experience and have some legacy applications that students need to access via RDS Remote Apps.  I could spin up an RDS server in Azure but we are a school and it would be costly to do so.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Saif ShaikhServer engineer

Commented:
Azure AD Connect supports connecting multiple forests to a single Azure AD tenant. A server that runs Azure AD Connect does not have to be joined to any domain locally, however, it must be able to access domain controllers in both forests.

 

In some cases, you can choose to place the Azure AD Connect server in a  (DMZ), especially if you do not have a direct network connection to all forests that you would like to include in the synchronization.
Saif ShaikhServer engineer

Commented:
Please look at supported topologies for Azure AD Connect here:

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies
Sr. Architect | Consulting
Commented:
I have done this many times. The AAD Connect server MUST be domain joined on a 2008 r2 or better (2016/2019 preferred) and not core! It is NOT supported to install 2 AAd connect servers (1 in each domain). It DOES work but not supported. The AAD Connect server needs to be installed in either domain with forest trust between them and both forests added into the AAD Connect. Very simple to setup.
Prerequisites: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-prerequisites
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Jeff GloverSr. Systems Administrator

Commented:
If what you put in the original question is accurate, the only issue you will have is if both Domains have the same UPN suffix. We are also an Education institution and for now, both our Student domain and our Staff domain are synced to the tenant via AADConnect. We can do this because they have completely different UPN suffixes. If the suffix is the same, i.e. @school.edu, then you may have an issue with AADConnect.
  BTW, our AADConnect server is not domain joined and we have had absolutely no issues. We simply make sure we can resolve both ADs from the Server which is in a DMZ and is a workgroup Server.
Alan CoxSr. Architect | Consulting

Commented:
working doesn't mean right:
directly from MS:
 
Important:

Installing Azure AD Connect on small business server, server essentials, or server core is not supported.

Azure AD Connect must be installed on Windows Server 2008 R2 or later. This server must be domain joined and may be a domain controller or a member server.

1 AAD connect per tenant

Having more than one Azure AD Connect sync server connected to a single Azure AD tenant is not supported.

I don't believe UPNs will make any difference as I've set them up with different UPNs and the same as long as the UPN is a registered domain in O365.
chilemooreVP of Information Technology

Author

Commented:
Thanks for the feedback.  our UPN suffix are different.
chilemooreVP of Information Technology

Author

Commented:
Thanks gentlemen.  I have some ground work to fix but will get this underway soon.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial