{"id":64226,"date":"2023-03-07T09:01:55","date_gmt":"2023-03-07T01:01:55","guid":{"rendered":"https:\/\/version-2.com\/?p=64226"},"modified":"2024-09-13T16:31:26","modified_gmt":"2024-09-13T08:31:26","slug":"why-on-prem-backup-for-azure-active-directory-isnt-enough","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2023\/03\/why-on-prem-backup-for-azure-active-directory-isnt-enough\/","title":{"rendered":"Why on-prem backup for Azure Active Directory isn\u2019t enough"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>

And 5 reasons why you should back up Azure AD in the cloud\u00a0<\/b><\/h4>

\u00a0<\/p>

\u00a0<\/p>

Imagine a busy city with multiple roads leading to various destinations, such as a hospital, a shopping mall, and a stadium. Just like a traffic light controlling the flow of vehicles to and from these destinations, Active Directory (AD) and Azure Active Directory (AAD) control the flow of and access to information from apps and services such as Microsoft 365, Salesforce, Google Workspace, and others. Organizations rely heavily on AD and AAD to ensure a smooth flow of and access to their data.\u00a0<\/p>

\u00a0<\/p>

However, just like how a city can experience traffic jams, frustrations, accidents, and general chaos when the traffic light is out, when AD or AAD are not accessible, the flow of and access to control-plane information can cause severe business disruption. This post will explore the importance of data protection for Azure AD.<\/p>

\u00a0<\/p><\/section>

The evolution of identity management:<\/b>\u00a0From Active Directory to Azure AD and the need for different backup solutions<\/h4>

\u00a0<\/p>

\u00a0<\/p>

But first, how did we come to rely so heavily on AD and AAD? Active Directory was introduced in 1999 as a solution for on-premises identity management, providing a centralized repository for user and device information and allowing administrators to manage these resources effectively and efficiently.<\/p>

\u00a0<\/p>

As the use of cloud-based services grew, the need for an identity management solution that could integrate with cloud-based resources became more important.\u00a0<\/p>

\u00a0<\/p>

This led to the creation of Azure Active Directory, which was designed to serve as the bridge between on-premises and cloud resources, not only creating a seamless and secure identity management solution for cloud computing, but also offering a range of features and capabilities (including single sign on, multi-factor authentication, and conditional access) to help organizations meet their security and compliance requirements.\u00a0<\/p>

\u00a0<\/p>

Microsoft Azure Active Directory and Active Directory seem to be a bit shrouded in mystery. For many, the distinction between them is not always clear, and this distinction becomes even more blurred when it comes to the topic of backing up and protecting the data within each.\u00a0<\/p>

\u00a0<\/p>

Instead of covering all the differences between AD and Azure AD, this post will mainly focus on backup for Azure AD, and it will explore five ways in which AAD requires a different backup solution from the traditional backups used for on-premises AD. Before we can do that though, we need to quickly establish \u2014 roughly \u2014 what the difference is.\u00a0<\/p><\/section>

<\/div><\/section>

What\u2019s the difference between AD and AAD?<\/b><\/h4>

\u00a0<\/p>

\u00a0<\/p>

As Stephen Covey put it, \u201cthe main thing is to keep the main thing the main thing.\u201d That quote might make more sense if you consider the key difference between cloud and on-prem AD to be the main thing\u2026 and in this case, the main difference between the two is that Active Directory is designed for managing user access and application infrastructure for an on-premises world; Azure Active Directory is for managing user access to cloud applications in a cloud-based environment.<\/p>

\u00a0<\/p>

\u00a0<\/p>

Even more simply? Sure: AD is on prem, AAD is cloud based.\u00a0<\/p>

\u00a0<\/p>

\u00a0<\/p>

If you\u2019re interested in exploring the differences further, here\u2019s what Microsoft has to say:\u00a0Compare Active Directory to Azure Active Directory.<\/a><\/p>

\u00a0<\/p>

\u00a0<\/p>

Every object in either AD or Azure AD has one permanent home. That\u2019s the primary copy of the object, and the copy to which changes are applied. If you are on-prem-only, or cloud-only, then there\u2019s only one copy of each object.<\/p>

\u00a0<\/p>

In hybrid mode, though, no matter where the object is homed, there will be two copies of it: the primary copy and a synchronized copy on the \u201cother side.\u201d<\/p><\/section>

<\/div><\/section>

For organizations using both Active Directory and Azure AD in a hybrid environment, you can think of the cloud copy of an on-prem object as being like a shadow. When you look at a shadow on the pavement, you\u2019re only getting a partial set of information about the real object.<\/p>

\u00a0<\/p>

In the same vein, Azure AD only has a partial set of attributes from on-premises AD objects because not every object attribute is replicated to the cloud. However, all the attributes of cloud-based Azure AD objects are stored in full in the cloud. This allows organizations to use Azure AD as an identity provider for on-premises resources and allows for SSO for cloud-based resources.<\/p>

\u00a0<\/p>

\u00a0<\/p>

How does this distinction change backup strategy?<\/b>\u00a0<\/p>

\u00a0<\/p>

The distinction of where (which environment) your identity objects are homed is paramount. Active Directory backup via on-premises solutions is exactly that: making a backup of on-prem data by copying it to\/from an on-premises solution. Azure Active Directory, as a cloud-based application utilizing cloud-based data (and metadata), creates and manages cloud data in the cloud.\u00a0<\/p>

\u00a0\u00a0<\/p>

\u00a0<\/p>

Why it matters: Comprehensive data coverage requires the \u2018right\u2019 backup<\/b><\/p>

\u00a0<\/p>

\u201cSome\u201d Azure AD data and metadata only exist in the cloud environment. You could copy these objects to an on-prem storage location (which is roughly as useful as putting backup tapes on top of the server they\u2019re made from), but these objects must be restored to the cloud.<\/p>

\u00a0<\/p>

Therefore, with clear gaps in coverage, the data and metadata are not covered holistically. This means your data may not be fully protected when you back up your cloud data with an on-premises Active Directory-oriented tool as your Azure AD backup solution.\u00a0<\/p>

\u00a0<\/p>

In other words: what\u2019s homed on premises and what\u2019s homed in the cloud are physically separate. You introduce new problems for yourself when you cross the streams, including speed of access, data fidelity and quality, and security.\u00a0<\/p>

\u00a0<\/p>

Let\u2019s dive into five reasons why on-prem AD backup is not a viable option for comprehensive backup of Azure AD.\u00a0<\/p>

\u00a0<\/p><\/section>

5 things you should consider if you\u2019re backing up AAD on premises<\/b><\/h4>

\u00a0<\/p>

\u00a0<\/p><\/section>

1. Some attributes in Azure Active Directory are not available on premises<\/h4>

\u00a0<\/p>

\u00a0<\/p>

If you take an on-prem AD account and sync it to the cloud, the sync process (and Azure AD) adds some attributes to it. Some of these may be synced back to on prem (a process called writeback) but some will not. Backing up Azure AD captures these; backing up the on-prem AD won\u2019t.\u00a0<\/p>

\u00a0<\/p><\/section>

2. Azure AD may have user objects or attributes that do not exist on premises\u00a0\u00a0<\/h4>

\u00a0<\/p>

\u00a0<\/p>

You can define your own users, groups, roles, et cetera, that exist only in the cloud. If you do not back these up independently, they will not be preserved nor well protected, and your only recourse is to recreate and define these custom entries every time.\u00a0<\/p>

\u00a0<\/p>

And yet not everyone sees the value in protecting these objects when their identity management (IdM) anchor is on prem. Even if an organization’s IdM anchor is on premises, objects and attributes like Intune and conditional access policies are important for several reasons, often forming a key part of organizations\u2019 zero trust security, and, as such, need to be protected against loss or damage. (Read our article on the zero trust principle here.<\/a>)<\/p>

\u00a0<\/p>

Still not convinced of the value of protecting control-plane objects? Here are five reasons highlighting the case for securing data protection:\u00a0<\/p>

\u00a0<\/p>