Why AAD Connect auto upgrade doesn't always upgrade

Azure AD Connect is a crucial component used to sync user accounts and enable mailboxes on-premises to be migrated to Microsoft 365. Not only does it synchronize accounts from Active Directory to Azure Active Directory, it also is used to configure authentication, provides ways for you to filter objects to sync, enables Exchange hybrid, allows for self-service password reset, enables seamless single sign-on, and more.

AAD Connect receives regular updates that include bug and security fixes as well as feature enhancements. Updates are normally delivered using AAD Connect's auto upgrade feature which is normally enabled by default. You can easily check to see if auto upgrade is configured by running the following cmdlet from your AAD Connect computer:

Get-ADSyncAutoUpgrade

Auto upgrade may be disabled if your deployment is more complicated (i.e., if you're using SQL Server instead of localDB, etc.) or if your admin has manually disabled it.

If AAD Connect auto upgrade is enabled, you may assume that it will automatically upgrade your AADC instance whenever a new version is released. That's not always the case. Clarification about this was recently added to the Azure AD Connect: Version release history website:

To clarify the use of Auto Upgrade, it is meant to push all important updates and critical fixes to you. This is not necessarily the latest version because not all versions will require/include a fix to a critical security issue (just one example of many). An issue like that would be addressed with a new version provided via Auto Upgrade. If there are no such issues, there are no updates pushed out using Auto Upgrade, and in general if you are using the latest auto upgrade version you should be good. However, if you’d like all the latest features and updates, the best way to see if there are any is to check this page and install them as you see fit.

Please follow this link to read more about auto upgrade.

In other words, auto upgrade will only upgrade if your version of AAD Connect needs it. This is similar to the way that Microsoft Update only applies updates for roles and features that are installed in Windows.

If you still want to manually install the latest version, simply download it from the Microsoft Azure Active Directory Connect website and install it. The current version number is listed in the Details section.

Read more ...

Article - Using Azure AD Application Proxy to Publish Internal Apps

Azure AD Application Proxy allows you easily and securely publish internal web applications to the Internet without modifying your firewalls. It adds another remote access tool to your arsenal.

Read my free article, "USING AZURE ACTIVE DIRECTORY APPLICATION PROXY TO PUBLISH INTERNAL APPS" on the ENow ESE Blog.

I've successfully used this strategy to publish Outlook on the web (OWA) for Exchange Hybrid Modern Auth customers. Let me know how I can help you!

Read more ...

AAD Connect version 1.5.18.0 is available now

Microsoft released AAD Connect version 1.5.18.0, which is a major version upgrade. Most AADC implementations should automatically upgrade to the latest version. Run Get-ADSyncAutoUpgrade to ensure automatic upgrade is enabled.

The most important functional change is that group objects now use mS-DS-ConsistencyGuid as the source anchor. This helps in multi-forest scenarios.

Read the Azure AD Connect: Version release history here.

1.5.18.0

Release status

04/02/2020: Released for download

Functional changes ADSyncAutoUpgrade

• Added support for the mS-DS-ConsistencyGuid feature for group objects. This allows you to move groups between forests or reconnect groups in AD to Azure AD where the AD group objectID has changed, e.g. when an AD server is rebuilt after a calamity. For more information see Moving groups between forests.
• The mS-DS-ConsistencyGuid attribute is automatically set on al synced groups and you do not have to do anything to enable this feature.
• Removed the Get-ADSyncRunProfile because it is no longer in use.
• Changed the warning you see when attempting to use an Enterprise Admin or Domain Admin account for the AD DS connector account to provide more context.
• Added a new cmdlet to remove objects from the connector space the old CSDelete.exe tool is removed, and it is replaced with the new Remove-ADSyncCSObject cmdlet. The Remove-ADSyncCSObject cmdlet takes a CsObject as input. This object can be retrieved by using the Get-ADSyncCSObject cmdlet.

 Note

The old CSDelete.exe tool has been removed and replaced with the new Remove-ADSyncCSObject cmdlet

Fixed issues

• Fixed a bug in the group writeback forest/OU selector on rerunning the Azure AD Connect wizard after disabling the feature.
• Introduced a new error page that will be displayed if the required DCOM registry values are missing with a new help link. Information is also written to log files.
• Fixed an issue with the creation of the Azure Active Directory synchronization account where enabling Directory Extensions or PHS may fail because the account has not propagated across all service replicas before attempted use.
• Fixed a bug in the sync errors compression utility that was not handling surrogate characters correctly.
• Fixed a bug in the auto upgrade which left the server in the scheduler suspended state.

Read more ...

Postpone upgrading AAD Connect if you deployed Hybrid Azure AD join

Microsoft has reported an issue with Azure AD Connect 1.4.18.0 and Hybrid Azure AD joined devices. They recommend not deploying this version if you have deployed Hybrid AAD join.

1.4.18.0https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-version-history#14180

Warning

We are investigating an incident where some customers are experiencing an issue with existing Hybrid Azure AD joined devices after upgrading to this version of Azure AD Connect. We advise customers who have deployed Hybrid Azure AD join to postpone upgrading to this version until the root cause of these issues are fully understood and mitigated. More information will be provided as soon as possible.

This version has been removed from manual download until their incident investigation is complete. The latest version available now on the website is AAD Connect 1.3.21.0.

Details of the incident are not available, but if you have deployed AADC 1.4.18.0 and are experiencing problems, I recommend completely uninstalling AAD Connect and installing version 1.3.21.0.

Read more ...