VBP365 account - create in on-prem or Azure AD?

[cfortenbery]

We have an on-premise Active Directory that syncs to Azure AD. We have migrated our Exchange environment to Office 35 and want to back that up using VBO365. Do we create the backup account VBO365 will use in Azure AD (as per instructions) or do we add it to our on-prem AD and let it sync? I am thinking as that account will not be needed to backup anything on-prem that putting it in Azure AD would be best but I am being told the person who worked on the AD integration that it can not be done that way (ie that it would be overwritten - I don't thing that is correct). Can anyone verify if the VBO365 backup account can be put on the Azure AD if it is being synced by an on-prem AD? Thanks in advance!

[Mike Resseler]

Hi @cfortenbery

I think you are correct. I see no reason why On-prem AD would overwrite it. It can be placed perfectly in AAD, which is something most do.

However, if you are just starting with VBO, is there a reason why you would not go for our latest update (4c) and use modern authentication without legacy protocols? MSFT will enforce this anyway somewhere next year...

[cfortenbery]

I didn't think it had to be in the on-prem AD and could just reside in the Azure AD, especially since the app registration and config can only be done in Azure AD. But I wanted to be 100% sure.

I'm planning on using MFA, but I still need an initial MFA-enabled service account in AD.

Thanks!

[Mike Resseler]

You need indeed an administrator to create the app registration.