question

Arpna-3737 avatar image
0 Votes"
Arpna-3737 asked amanpreetsingh-msft commented

How we can sync on premise active directory data with Azure AD via graph API

We are having on premise employee directory and now planning to move to Azure AD. How we can sync the details of all employees to Azure using graph API, and provide them access to hardware and network.

We basically want to sync Entries, Computer, user, Group, InetOrgPerson, OU present in local AD to Azure AD.

azure-active-directorymicrosoft-graph-sdk
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

amanpreetsingh-msft avatar image
0 Votes"
amanpreetsingh-msft answered amanpreetsingh-msft commented

Hi @Arpna-3737 • Thank you for reaching out.

Graph API can NOT be used to sync the identities from On-premises AD to Azure AD. Using Graph API, you can create/read/update/delete objects in Azure AD, but you cannot sync the objects using Graph.

To sync objects from On-premises AD to Azure AD, the recommended tool is Azure AD Connect. You can use it to sync Users, Groups and Computer objects but not OUs as Azure AD doesn't support the concept of OUs.

Read more: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-express


Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

thanks a lot @amanpreetsingh

Using Graph API, you can create/read/update/delete objects in Azure AD

I think this should be good enough for us to start with. We basically want to move all our infra related resource to Azure as first step. We have lot of resources like:
- Employess -> I believe this could be mapped to User object in graph - https://docs.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-beta
- Computers -> I believe this could be mapped to Device object in graph - https://docs.microsoft.com/en-us/graph/api/resources/device?view=graph-rest-beta
- OU are not supported in Azure AD so I need to revisit this.
- Groups - Could be mapped with groups object in graph - https://docs.microsoft.com/en-us/graph/office365-groups-concept-overview

We also have concept of InetOrgPerson. Is there anything else I should consider for exploring the APIs?

thanks again for your help.



0 Votes 0 ·

Hi Arpna,

Moving the Infra services to Azure needs a good planning and strategy to avoid any potential issues or limitations. Graph APIs are not solely meant for migration purpose,

IAre you currently running domain controllers and looking to get replaced with Azure AD in future state. ? what are the types of resources you planning to migrate. Please provide more details.

0 Votes 0 ·

@Dev073 thanks a lot for the reply.

We are planning to move our infra (employees, groups, laptops, servers info) to Azure as first step and then we can plan on moving policies and other stuff.

why we have chosen graph API, is that we want to see if we can finer control on data that we are moving to Azure and make periodic updates to Azure AD.

0 Votes 0 ·

Hi @Arpna-3737 • For InetOrgPerson, you may consider Guest Users in Azure AD. You may consider using invitation manager via graph as per https://docs.microsoft.com/en-us/graph/api/invitation-post?view=graph-rest-1.0&tabs=http.

I am not sure what you mean by mapping here, but graph doesn't provide a way to map on-prem users to Azure AD. Also, how are you going to keep track of changes on-prem and make corresponding changes in Azure?

Again, better choice would be to go with AD Connect as syncing identities from on-premises AD to Azure AD via AD Connect is recommended by Microsoft and it makes mapping, management and administration much simpler & less time consuming.


Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

0 Votes 0 ·