Azure AD Connect Health with AD DS is now in preview!
You’ll need Azure AD Premium for this, but it’s a little agent that gets installed on each of your domain controllers and provides health and alerting via Azure AD Connect Health.
The service is a light health and monitoring solution which reports back on some basics such as these:
Also, it will show any replication issues and other DC related problems for you to re-mediate. You can also configure email alerts, so you know when a problem is detected, rather than relying on checking the health page to notice something.
The setup of Azure AD Connect Health with AD DS is incredibly easy – download and install the agent (check you meet the prerequisites first!), use credentials of an Azure AD global administrator (set up a service account for this), and you’re done. If you install it on a server that doesn’t have the required Windows Server roles, you’ll get an error such as ” Microsoft.Identity.Health.Common.RoleNotFoundException: No role was registered. “
The two other currently Health services are for ADFS and Azure AD Connect, so check those out too if you haven’t already.
One issue I had after installing was that I couldn’t see the box for Active Directory Domain Services in the Azure portal, it was just blank:
After trying to work out why for a while, @kengoodwin pointed out that I should try resetting the view. This is done by clicking one of the ‘Add tiles’ options, then at the top of the screen choosing hte ‘Restore default’ option.
Doing this resulted in my tiles showing as they should – I’d never made adjustments to my tiles, but had previously gone into edit mode and saved the zero changes I did, which I believe stopped the portal from adding in the new tiles once the new health service was detected. This is how it should look:
Much better!
If you have Azure AD premium, then check out this free extra!
What are the required Windows roles? The prerequisites page mentions nothing of a role to install.
Hi Wayne,
Some of the Technet articles are a little confusing. When they refer to roles in this context, they mean the role options of Azure AD Connect Health. There’s 3 right now – Azure AD Connect, ADFS and AD DS.
https://docs.microsoft.com/en-gb/azure/active-directory/connect-health/active-directory-aadconnect-health-faq
Depending on your OS there’s different install instructions. Install it and see how you go, Azure will tell you if it’s not happy and give some troubleshooting steps (health scripts to run).
Feel free to ask here if you get stuck.
Thanks for your reply! I already have an Azure AD Connect server for our hybrid setup. The link you posted above appears to say I should install the AD Connect Health agent on the AD Connect server, however I see other MS documents saying to install it on all the Domain Controllers https://docs.microsoft.com/en-us/azure/active-directory/connect-health/active-directory-aadconnect-health-agent-install and your link says I will need a lot of licenses (we have 4 DCs).
I guess the main problem is right after I enter the Office 365 global admin credentials I get this error
Configuration Failed
To retry configuration, type:
Register-AzureADConnectHealthADFSAgent
Monitoring will not start until configuration is successful.
Register-AzureADConnectHealthADFSAgent : No role was registered.
At line:1 char:190
+ … \AdHealthAdfs; Register-AzureADConnectHealthADFSAgent}
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Register-AzureADConnectHealthADFSAgent], RoleNotFoundException
+ FullyQualifiedErrorId : Microsoft.Identity.Health.Common.RoleNotFoundException,Microsoft.Identity.Health.Adfs.Po
werShell.ConfigurationModule.RegisterADHealthAdfsAgent
PS I am installing on Windows 2012 and I tried your suggestion to install Windows Management Framework 5.0 without any luck.
Thanks again
Hi Wayne,
There’s a different installer for each role – one for ADFS, one for DC and one for Connect. That looks like you’re using the ADFS one and it’s expecting the ADFS role, is that the one you’re expecting?
I guess I am confused. I already have an Azure AD Connect server (I assume that is the “Connect” you refer to above) and our on-premises domain and Office 365 are in sync. Now I am attempting to install Azure AD Connect Health and I receive that error.
Do I need to install something before installing Azure AD Connect Health?
Thanks!
Hi Wayne,
Here’s all the agents
https://docs.microsoft.com/en-us/azure/active-directory/connect-health/active-directory-aadconnect-health#download-and-install-azure-ad-connect-health-agent
It sounds like you just want to monitor health for Azure AD Connect itself (which they refer to as sync), and not ADFS or DS.
Try this client and see what happens:
https://www.microsoft.com/en-us/download/details.aspx?id=47594