I want to include on-premise Virtual Machine into Azure Active Directory. I don't have much idea how to implement this. Kindly let me know the steps to perform this.

  • What do you want to achieve with that connection? Should AAD-Only users be able to access your OnPremises SharePoint? – MHeld Mar 1 '18 at 10:21
  • Yes, I want only AAD users to acess on-premise Virtual Machine. Is there any way to achieve this? – Divya Sharma Mar 1 '18 at 11:19

Unfortunately you go the "wrong" direction from Microsoft's perspective. Integrating OnPremises Users to SP Online works like a charm. The way back is much more complicated.

You need to configure a TrustedIdentityTokenIssuer (TST) in SharePoint. This will make SharePoint trust another source for identities in addition to OnPremises ActiveDirectory.

  • Set up OnPremises ADFS and add it as an Application in Azure AD
  • Add Azure AD as an Identity Provider in ADFS
  • Create Relying Party in SharePoint and Add Pass Thru Rule
  • Create SPTrustedIdentityTokenIssuer in SharePoint

The whole process is described here in detail (skip step 1 in the blog as you want to enable AAD-Only users): Using Azure AD as an Identity Provider with ADFS for SharePoint 2013

Integrating a TST into SharePoint comes with a lot of drawbacks and more complexity. Link is for FormsBasedAuthentication (FBA), but those drawbacks also apply to a TST. So test this scenario excessive and then decide if it is really the answer to your needs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.