Azure fedrated and question about moving FSMO roles to the cloud

AzureAddict 26 Reputation points
2020-08-18T16:41:29.3+00:00

Dear all

We took on a new client and they are using federated for Azure authentication for some of their domains. I know that this means authentication is done on-premises and is the key factor for companies to use this option compared to the likes of pass-thrue (which I guess is also on prem using agents right) and hash. They have a hybrid environment so they have a few domain controllers on-prem of course with the usual two in Azure and might even have some additional one's in Azure.

Our client is asking us to move all FSMO roles from on-prem to the domain controllers in Azure and thinking about this I cannot really find a good reason they would want to do this. Correct me if I am missing something but would there be any reason why anyone would want to move FSMO roles from on-prem to the cloud? Moreover if the PDC role remains on prem and authentication needs to be on-prem because it is federated would it not make more sense to leave the FSMO roles where they are as well to also factor in things like password changes where every DC needs to talk to the PDC?

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,189 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,437 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alfredo Revilla - Senior Freelance SWE, SWA, IAM 27,016 Reputation points
    2020-08-18T18:17:32.983+00:00

    Microsoft does not recommend moving master roles to Azure VMs.

    --
    Please let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.

    1 person found this answer helpful.
    0 comments