Implementing Azure：Putting Modern DevOps to Use

上QQ阅读APP看书，第一时间看更新

Azure AD Connect highly available infrastructure

Now you know how to set up a basic AD synchronization without considering the availability infrastructure, we'll look at how you can achieve Azure AD synchronization in a high availability environment.

The first thing you should know is that the Azure AD Connect tool cannot be clustered, so you need to use staged mode to implement it in passive mode. In the case of a failure, you have three days to recover the AD Connect Server. This can be either done through recovering from backup redeployment or switching to the staged, passive AD Connect Server.

So, for placement in either high availability or non-high availability infrastructures, it is recommended that you place systems that are involved in the synchronization of Azure VMs. This is so that you do not transfer as much data through the open internet, thus improves the performance of communication and identity token exchanges between Microsoft Cloud Services. More details about these concepts will be given in the next chapter about Azure networking.

In our high-availability scenario, every active and primary source of synchronization is placed into Azure and configured with either Availability Zones (AZs) or sets. A connection to on-premises is done through a virtual private network (VPN) or Multiprotocol Label Switching (MPLS) connection.

So, to have a user and password synchronization option in a high-availability environment, we need the following system:

Two AD DCs with global catalog and DNS
Two Azure AD Connect servers, one in active and one in staged mode

For the DCs and database servers, both will automatically fail-over if one system fails. For the Azure AD Connect server, you need to disable staged mode and perform the fail-over manually.

Looking at a more complex scenario, if you want to implement a high availability AD FS infrastructure, some additional systems are needed:

Two AD DCs with global catalog and DNS
Two Azure AD Connect servers, one in active and one in staged mode
Two AD federation servers
Two AD federation proxies

Such an infrastructure could look like the following architectural schema:

Microsoft recently published a very good guide deploying AD FS in Azure. You can find the guide through the following link: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-azure-adfs.