Azure AD Connect Prerequisites

Before you install Azure AD Connect

Azure AD
- You need an Azure AD tenant. You get one with an Azure free trial. Manage it through:
  - The Azure portal
  - The Office portal
- Add and verify the domain you plan to use in Azure AD (e.g., contoso.com). Ensure this domain is verified and not just using the default contoso.onmicrosoft.com domain.
- Default limit for Azure AD tenant: 50,000 objects. Verified domain increases limit to 300,000. For more than 500,000 objects, a license such as Microsoft 365, Azure AD Premium, or Enterprise Mobility + Security is required.

Active Directory schema version and forest functional level must be Windows Server 2003 or later. Domain controllers can run any version as long as the schema version and forest-level requirements are met.
The domain controller used by Azure AD must be writable. Read-only domain controllers (RODC) aren't supported.
On-premises forests or domains using "dotted" NetBIOS names aren't supported.
Recommend enabling the Active Directory recycle bin.

Azure AD Connect runs signed PowerShell scripts. Ensure the PowerShell execution policy allows script execution.
Recommended execution policy: "RemoteSigned".

Administrative access to the Azure AD Connect server must be properly secured. Follow guidelines in Securing Privileged Access.
Treat the Azure AD Connect server as a Tier 0 component. Hardening recommendations are available in Secure Privileged Access.

Install Azure AD Connect on a domain-joined Windows Server 2016 or later. Using Windows Server 2022 is recommended.
Minimum .NET Framework version required: 4.6.2. Newer versions are supported, with 4.8 offering the best accessibility compliance.
Azure AD Connect cannot be installed on Small Business Server or Windows Server Essentials before 2019.
The Azure AD Connect server must have a full GUI installed.
PowerShell Transcription Group Policy must not be enabled if using Azure AD Connect wizard for AD FS configuration.
If deploying AD FS:
- Servers must be Windows Server 2012 R2 or later.
- Configure TLS/SSL certificates and name resolution.
Ensure the URL https://secure.aadcdn.microsoftonline-p.com is in the trusted sites list if MFA is enabled.
Verify prerequisites for Azure AD Connect Health if used for syncing.

Hardening recommendations include restricting administrative access and creating dedicated accounts for privileged personnel.
Implement unique local administrator passwords and follow additional security guidelines.
Enable Multi-Factor Authentication (MFA) for privileged access.
Disable Soft Matching and Hard Match Takeover if not required.

Default: SQL Server 2019 Express LocalDB. For more objects, use a different SQL Server installation.
Requirements for SQL Server:
- Case-insensitive SQL collation (identified with _CI_ in their name).
- Only one sync engine per SQL instance.

Azure AD Global Administrator or Hybrid Identity Administrator account required.
Enterprise Administrator account needed if using express settings or upgrading from DirSync.
Custom settings installation path provides more options.

The Azure AD Connect server needs DNS resolution for both intranet and internet.
Ensure network connectivity to all configured domains and forests.
Check firewall and proxy settings to ensure required URLs are accessible.
Azure AD Connect uses TLS 1.2 for encrypting communication. Follow steps to enable TLS 1.2 if not already enabled.

Azure AD Connect installs various components including Azure AD Connect Health, Microsoft SQL Server 2019 Command Line Utilities, Microsoft SQL Server 2019 Express Local DB, and others.

The following table shows the minimum requirements for the Azure AD Connect sync computer:

Number of Objects in Active Directory	CPU	Memory	Hard Drive Size
Fewer than 10,000	1.6 GHz	6 GB	70 GB
10,000–50,000	1.6 GHz	6 GB	70 GB
50,000–100,000	2.0 GHz	6 GB	70 GB
100,000–300,000	2.0 GHz	8 GB	70 GB
300,000–500,000	2.0 GHz	8 GB	70 GB
500,000+	2.0 GHz	8 GB	70 GB