Pass-through authentication failing with some DCs offline
We’re taking our HQ building offline at the end of the week for a full switch infrastructure refresh - so all users will be remotely working.
In readiness this evening we tested that users would still be able to sign-in to Office365 and all cloud services inc. those with SSO to Entra. To simulate our HQ building being offline we took down both DCs at this site, leaving our Azure VM DC up and a DC at our branch office location up.
Unfortunately things didn’t go as expected…users couldn’t pass-through authenticate.
We’ve got an Entra Connect with PTA instance in Azure (active), and a second instance at our HQ in staging mode. The only time we could get PTA to work was when we also switched OFF the Entra Connect instance at our HQ…just leaving the Azure DC and Azure Entra Connect.
Entra wants multiple Entra Connect and PTA agents - but it seems like they become a problem if they are up with no local DCs.
Any ideas? Experience of Entra Connect in a failure scenario? Should it be seamless?
I’m wondering if maybe a DNS configuration issue on the HQ Entra Connect instance - does it need the DNS address of the non-HQ DCs?