With AAD Connect and a hybrid AD setup, this is untrue… The example is an external consultant that in a project has a limited time on the AD Account, and in a onprem environment, an expired account = a blocked account.
This is a fact, and it not good that a user that is considered to be deactivated, is still able to access an organizations services in the cloud. It can be used in Office 365, in Azure, in other connected Cloud services/SaaS applications out there.
This in itself is not that big of a deal, but the fact that an expired user in AD, that is blocked for use and login onprem, is fine to use in the cloud environment. In a hybrid environment where an AAD Connect is configured to sync the onprem/classic Active directory and its users to Azure Active Directory, the expire date property in AD is not synced.
0 kommentar(er)
