Office365 DirSync

[timbo343]

We currently have an on-prem exchange server which is used for staff email and we have office365 emails for students. We have so many problems with students accessing their emails as they

 

1. don't think its important

2. they don''t know their details - even though we have things in their planners and on our landing page to help them remember the details

 

so i thought i would have a look at DirSync with OU level filtering to sync student email accounts to Office365 so they can use the same details.

 

I thought it would be straight forward but I'm failing at the first hurdle. In Office365 i expand users > active users and click on Setup next to Active Directory Sync. I get taken to a short questionnaire about is Directory Sync right for you. I select 251 or greater and yep it tells me that directory sync is right for me - happy days .

 

The problem comes when we need to find the On-Premises domains.

Our on-prem domain is {internaldomain}.com.

Our email and web domain is {externaldomain}.co.uk.

Our Office365 domain for students is students.{externaldomain}.co.uk.

 

How do i authorise my internal domain?

Am i right in thinking i just need to get my external Domain Admin (in this case, my ISP) to add the TXT record to my sub-domain students.{externaldomain}.co.uk?

 

I take it I don't need to MS to send me an email to confirm i own {internaldomain}.com?

[skell]

Yes, just your external domain needs to be authorised.

[timbo343]

But why is the external domain authorised when we are syncing the internal domain? Something doesn't make sense unless i'm missing something.

[skell]

You set the UPN of each student to your external domain in AD.

[Soulfish]

But why is the external domain authorised when we are syncing the internal domain? Something doesn't make sense unless i'm missing something.

 

O365 users need to have an internet routable UPN i.e [email protected] (see here for more info). If your current on-prem AD uses a non-internet routable domain (i.e. [email protected]) then you'll need to look at either changing the UPNs of your users (which may, or may not be possible. here explains how to change it ) or alternatively looking to setup ADFS 3.0 and using AlternateLoginID - https://blogs.perficient.com/microsoft/2014/04/office-365-configuring-ad-fs-dirsync-with-an-alternate-login/

[timbo343]

You set the UPN of each student to your external domain in AD.

 

Ha! Oh! the UPN i have in there is @{internaldomain}.com which is different to @{externaldomain}.co.uk

 

O365 users need to have an internet routable UPN i.e [email protected] (see here for more info). If your current on-prem AD uses a non-internet routable domain (i.e. [email protected]) then you'll need to look at either changing the UPNs of your users (which may, or may not be possible. here explains how to change it ) or alternatively looking to setup ADFS 3.0 and using AlternateLoginID - https://blogs.perficient.com/microsoft/2014/04/office-365-configuring-ad-fs-dirsync-with-an-alternate-login/

 

Looks like I'll have to have a look at this.

[timbo343]

You set the UPN of each student to your external domain in AD.

 

Not as bad as i thought lol! I thought it was going to be a nightmare but didn't realise that the UPN and the UserLogonName (pre-windows2000) i guess this is the sAM were completely different, i thought they were the same! My UPN are all set to @{internaldomain}.com. Looks like i'm going to have to go through each student and set to @ students.{externaldomain}.co.uk. Same with staff too @{externaldomain}.co.uk unless i can find a PS script to do it .

[skell]

Something like this

 

get-aduser -searchbase "ou=Students,dc=your,dc=domain,dc=here" -Filter * | foreach { Set-ADUser -UserPrincipalName "@domain.com" }

 

I'd test that first. I've lost the script I used.

Edited November 18, 2015 by skell

[mikkydoos]

But why is the external domain authorised when we are syncing the internal domain? Something doesn't make sense unless i'm missing something.

 

It doesn't matter what your internal domain is called. It syncs users AD info when you license your users, that's where you tell it which (external) domain to use for their email address.

You can do this en-mass with a powershell command.

 

 

You need to verify ownership of your external domain by setting up a few A and TXT records with your domain name host.

There are different records to set up for different features of O365.

 

The DNS is usually quite quick to update once you've done this.

Edited November 18, 2015 by mikkydoos

[john]

Not as bad as i thought lol! I thought it was going to be a nightmare but didn't realise that the UPN and the UserLogonName (pre-windows2000) i guess this is the sAM were completely different, i thought they were the same! My UPN are all set to @{internaldomain}.com. Looks like i'm going to have to go through each student and set to @ students.{externaldomain}.co.uk. Same with staff too @{externaldomain}.co.uk unless i can find a PS script to do it .

 

You can just bulk select in AD and change that it keeps the first bit fine and just swaps the end (we had 1000+ to do in batches for different sub domains here).

[Davit2005]

Moved Students to Office365 a few years back. Ran PowerShell scripts to set the UPN as the external domain and it hasn't caused any issues for us.

 

New accounts are created with the external UPN, SMTP and mail attributes correctly configured ready for DirSync to synchronize.

[timbo343]

Now im struggling to get Azure AD working as i've found out that DirSync is no longer available.

 

I've got a specific VM for AD / Office365 sync and ive created a specific user for this purpose. The user doesn't have any proxy details set and the server bypasses the smoothwall proxy. This user is a member of Enterprise Admins and no matter what i try i keep getting this error:

 

[09:05:32.263] [ 9] [ERROR] Caught exception while creating synchronization account. Exception Data (Raw): System.DirectoryServices.DirectoryServicesCOMException (0x8007202F): A constraint violation occurred.

 

After doing a quick search i have found this article:

 

https://social.msdn.microsoft.com/Forums/azure/en-US/2dac3755-e1d9-463d-93a7-213bb7ded4f1/azure-ad-connect-giving-errors?forum=WindowsAzureAD

 

It tells me to allow specific sites however if there isn't a proxy configured, this doesn't fix the issue.

 

Can anyone help?

[timbo343]

Just to add to the error, during setup of Azure Active Directory sync on the server, the error occurs at the "Windows Azure Active Directory Connector."

 

Oh hang on a minute, have i got to activate Azure AD in office365?

Edited November 20, 2015 by timbo343

[sparkeh]

Oh hang on a minute, have i got to activate Azure AD in office365?

Just doing this myself

There doesn't appear to be an option to add Azure AD as a subscription like the Student and Faculty Exchange options. Though I currently have Azure Rights Management as a trial. I hazard a guess that when the trial ends we will be able to continue to use it as its one of the things thats free to education customers?

 

Also can I just clarify, changing users UPN from the internal domain to our external domain doesn't have any consequences for users?

[timbo343]

Just doing this myself

There doesn't appear to be an option to add Azure AD as a subscription like the Student and Faculty Exchange options. Though I currently have Azure Rights Management as a trial. I hazard a guess that when the trial ends we will be able to continue to use it as its one of the things thats free to education customers?

 

Also can I just clarify, changing users UPN from the internal domain to our external domain doesn't have any consequences for users?

 

I'm not too sure about when it ends. Maybe a supplier on here can advise us? @Millgate maybe?

 

I'm going to test a specific OU first but from what i have read, adding a different @{domain} via Domains and Trusts and then changing the UPN in account of a user doesn't affect the onPrem domain or login. My O365sync user though still has @{internaldomain} UPN, i wonder if that's the reason why its failing, although it shouldn't matter.

 

I'd be interested to see if yours completes without any errors.

[Boredguy]

Also can I just clarify, changing users UPN from the internal domain to our external domain doesn't have any consequences for users?

Nope should have no effect on your users when you switch the UPN to match your e-mail domain instead of your internal domain.

[timbo343]

Now im struggling to get Azure AD working as i've found out that DirSync is no longer available.

 

I've got a specific VM for AD / Office365 sync and ive created a specific user for this purpose. The user doesn't have any proxy details set and the server bypasses the smoothwall proxy. This user is a member of Enterprise Admins and no matter what i try i keep getting this error:

 

[09:05:32.263] [ 9] [ERROR] Caught exception while creating synchronization account. Exception Data (Raw): System.DirectoryServices.DirectoryServicesCOMException (0x8007202F): A constraint violation occurred.

 

After doing a quick search i have found this article:

 

https://social.msdn.microsoft.com/Forums/azure/en-US/2dac3755-e1d9-463d-93a7-213bb7ded4f1/azure-ad-connect-giving-errors?forum=WindowsAzureAD

 

It tells me to allow specific sites however if there isn't a proxy configured, this doesn't fix the issue.

 

Can anyone help?

 

I thought this might have helped but it doesn't

 

http://www.edugeek.net/forums/cloud-services/99050-office-365-dirsync-issue-constraint-validation-has-occured-fixed.html

[timbo343]

Oooh Oooh, got a bit further... My onPrem Sync account needed to be a member of... Administrators, Domain Admin, Enterprise Admin.

 

Looks like its getting further.

 

Hope this helps someone else out.

[timbo343]

Ok, ive got the AAD sync tool up, followed the guide here https://msdn.microsoft.com/en-us/library/azure/dn801051.aspx on how to configure organizational unit-based filtering however what does a full import do? Does it take everything over or just the folder structure?

 

I have partly run the full import as i thought the whole of AD was been transferred over and then ran Delta Sync.

 

If I re-run a full sync and then run delta is this everything i need to do or is there another step?

[sparkeh]

Ok got it synced, did a full sync and it synced users and groups.

However some of the groups seems to be a bit messed up with object not found errors.

 

Scratch that, I hadn't waited for the sync to finish. :S

Edited November 20, 2015 by sparkeh

[timbo343]

Ok got it synced, did a full sync and it synced users and groups.

However some of the groups seems to be a bit messed up with object not found errors.

 

Scratch that, I hadn't waited for the sync to finish. :S

 

I'm only testing at the moment as students are using office365 for email only but want to test a test account before i transfer everything over. The Sync completed as well as Delta Sync but the AD credentials dont work on office365.

[sparkeh]

I'm only testing at the moment as students are using office365 for email only but want to test a test account before i transfer everything over. The Sync completed as well as Delta Sync but the AD credentials dont work on office365.

Hmm after syncing our accounts can log in with their network login + password...

[timbo343]

hmmmm..

 

In your Synchronization Service Manager do you have a number next to disconnectors as mine is stating i have 9.

 

Also, in Connectors - which one should i be syncing... I take it i should be syncing the onPrem domain rather than the external domain?

[sparkeh]

hmmmm..

 

In your Synchronization Service Manager do you have a number next to disconnectors as mine is stating i have 9.

Sorry probably being dumb but where am I looking? I can't see anything about disconnectors.

Also, in Connectors - which one should i be syncing... I take it i should be syncing the onPrem domain rather than the external domain?

When I run the sync is does both, i.e. it runs a sync for {domain}.onmicrosoft.com and then for {internal domain}.

[timbo343]

Ive attached screen shots of what im getting. Im only syncing the second connector which is the onPrem domain. The other screen shot is the Manage screen of Office365 sync which can access by clicking Users > Active > Manage from the top of the users screen.