Windows 10: Foreign Security Principals - Azure AD Sync

Hi,My AD Forest AD_Forest_EUR is part of an M365 Tenant alongside the separate AD Forest AD_Forest_NA of our parent company. A two-way transitive trust exists between AD_Forest_EUR and AD_Forest_NA and both forests sync up to Azure via a single Azure AD Connect instance located in AD_Forest_NA.Within the M365 tenant, Self Service Password Reset SSPR is selectively enabled for all members of a security group located in a sub-domain of AD_Forest_NA. We want SSPR to work for the users in AD_Forest_EUR so we nested a group from that forested into the security group which is located in the su

:)

 

Active user accounts from local domain and unused FSP objects in Foreign Security Principals Container

Hello,

I have local domain: Accounts.root.corp. There is 2 way external trust relationship with external domains: infra1.local and infra2.local.

In my local domain Accounts.root.corp under Foreign Security Principals container, there are FSP objects showing from external domains infra1.local and infra2.local. However, I'm wondering why there are so many active user accounts from local domain: Accounts.root.corp
showing under Foreign Security Principals? As per the definition, it should only contains security Principals in a trusted external domain/forest.

Apart from this, how do I validate usage of FSP objects in my domain. How do I determine whether certain FSP objects should be removed or not from my local domain?

 

I am try to sync Azure Ad to WIndows AD

I have users to Azure AD and I want those user to sync to Windows AD my understanding is AD azure connect only sync one way that from windows ad to Azure AD but I need something that does it the other way around

 

Moving On-Premise AD Users to Azure AD

Hi,

Currently we have our on-premise AD syncing to our Azure AD. We want to remove our on-premise AD and move all of our users to Azure AD. Since every user is already synced to our Azure AD, can we shut down our on-premise AD and connect our computers to the Azure AD? Will the synced users stay in Azure AD?

Thank you,

Matt