This document discusses identity and authentication options for Office 365 and hybrid scenarios. It outlines the different approaches including cloud identity, directory sync, federated identity, and on-premises identity. It also covers federated search capabilities between SharePoint Online and SharePoint Server. Additional topics include user profile synchronization and migrating additional user properties.

3. Thomas Vochten
Office Server & Services MVP
Platform architect with a thing for SharePoint.
Speaker. Trainer. Involuntary DBA. Architect at Xylos.
@thomasvochten
http://thomasvochten.com
mail@thomasvochten.com

4. •
•
•
•

6. Opportunity!

7. or Threat?

8. Innovation is cloud-first

9. •
•
•
•
•

10. •
•
•
•
•
•
•

13. •
•
•
•
•
•
•
•
•
•
•

14. Cloud Identity
Single identity in the cloud
Suitable for small
organizations with no
integration to on-premises
directories
Directory &
Password Sync*
Single identity
suitable for medium
and large organizations
without federation*
Federated Identity
Single federated identity
and credentials suitable
for medium and large
organizations
On Premises Identity
Domain based identity
solution suitable for all
organizations
• Synchronized with
password or federated
identities
• Internet routable AD
domain (Name)

15. •
•
•
•
•
•

16. •
•
•
•
•

19. •
•
•
•
•

20. Federated search
resultsPrimary web app
SharePoint Online
InternetMicrosoft data center Intranet
Federated search
results Site collection
Office 365 tenant
SharePoint
SharePoint Online can query SharePoint Server
• Search: Bidirectional
• Business Connectivity Services: Supported
• Duet Enterprise for SharePoint and SAP: Supported
SharePoint Server 2013
SharePoint Server can query SharePoint Online
Inbound
On-premises SharePoint Server 2013 Enterprise Search portal and SharePoint Online search portal: Local and remote
search results are available. If extranet authentication services are configured, extranet users can log in remotely through
an on-premises Active Directory account and use all available hybrid functionality.
Perimeter
network
Customer network
Outbound

22. •
•
•
•

26. 


42. •
•

43. You might want to migrate additional properties
that are not synced by AAD Connect
User Profile Batch Update API
http://thvo.me/pnpuserupdate

45. •
•

46. •
•
•

50. •
•
•
•
•

53. •
•
•
•
•
•
•