We have a bunch of Azure users that need access to on-prem AD resources.
I.e. we want user@company.com to be able to access company.local resources without a separate company\user login.
Both our Azure AD and our on-prem are stable and I would like to avoid combining them with Azure AD Connect. Doubly so because we're planning on phasing out on-prem entirely within the next couple of years and it seems like there isn't an option to make Azure the master instead of on-prem. It seemed like the requirement was very simple, but I'm having a tough time creating an architecture in which our on-prem trusts Azure users.
I thought Azure AD DS would solve this because it creates a separate domain that our Azure users are automatically synced to, which could then be trusted by our on-prem.
This article
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/identity/
mentions creating an Azure AD DS domain and joining it to an on prem forest. Linked to this architecture: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-extend-domain
The first article also recommends creating a separate forest and letting on prem forest trust the Azure AD DS forest: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-forest
However, digging deeper into these resources, they usually all discuss your Azure AD DS forest having a one-way outbound trust to the on-prem AD. I believe I would need the opposite (a one-way inbound trust to the on-prem). Is there a stable and reliable way to trust my Azure domain so I can let these cloud-only users access on-prem AD resources?
