

And as best practice, treat all servers running Authentication Agents as Tier 0 systems (see reference). There is a system limit of 40 Authentication Agents per tenant. In production environments, we recommend that you have a minimum of 3 Authentication Agents running on your tenant. If you already have Azure AD Connect running, ensure that the version is supported.
#R check active tables in environment install#
Install the latest version of Azure AD Connect on the server identified in the preceding step. It should be noted that installation of Pass-Through Authentication agent on Windows Server Core versions is not supported. Add the server to the same Active Directory forest as the users whose passwords you need to validate. If not enabled already, enable TLS 1.2 on the server. Identify a server running Windows Server 2016 or later to run Azure AD Connect. Your users can sign in with one of these domain names. Add one or more custom domain names to your Azure AD tenant.Completing this step is critical to ensure that you don't get locked out of your tenant.

Learn about adding a cloud-only Hybrid Identity Administrator account. This way, you can manage the configuration of your tenant should your on-premises services fail or become unavailable.
