So long story short, there is not necessarily a correct approach that applies across the board, it really depends on what experience you want your users to have as well as any future plans you may have that could require synchronized identities. I have about 120 users and this seems the best model for me, taking into account I save on having to provision an ad sync server ,back it up, install AV and troubleshoot ad sync errors when it breaks. The benefit of AADC is that it has become more robust over the last year or two where features like pass-through authentication and seamless SSO can give your users a much nicer authentication experience without a complex ADFS infrastructure. I am interested in hearing from any admins who are using the cloud sign in model for their office 365 users. There are complexities that you do have to take into consideration, such as making sure your on-premises directory is relatively clean and healthy as well as possibly troubleshooting some attribute conflicts before sync can be established, but overall management and administration after it is setup is minimal.
It's not necessarily considered a "real-time" service so if there is a catastrophic failure, in my experience it is very easy to rebuild as long as you have the original configuration documented. Setting up and using AADC is relatively simple, but again this depends on your specific environment and what you want to accomplish. Would you ever foresee the need to users to have a consistent logon experience between O365 and on-premises? Would you ever need to federate with any on-premises applications or cloud services? Or would you ever need to have a single-sign on experience for your users? A lot of this is based on user experience, but if any of these things you think you may need in the future, setting up directory synchronization may be a good idea. Select the option you are having issues with, and help provide feedback to the service. I would suggest taking into consideration any long-term or future plans you may have. The main downside to cloud authentication is that it is a separate password for users to remember, but if your users are not opposed to this and understand that their O365 accounts are different than any other accounts they use then it would appear that is not a drawback for you. Federated authentication is all based on what works best for your specific environment.
0 kommentar(er)
