PSA: DirSync & Password Sync now available for Office 365

[jamesbmarshall]

Since I know this is a feature close to the hearts of many of you, I thought I'd share this:

 

Synchronising passwords with Office 365 - UK Education Cloud Blog - Site Home - MSDN Blogs

[AngryTechnician]

Well, I know what I'm doing after lunch!

[plexer]

So as long as my users have a upn suffix that matches our office 365 tenant details and I setup this tool I can sync their on prem passwords into the cloud?

 

Ben

[AngryTechnician]

Yep, just done it here and it's working great.

[zag]

Fantastic! finally!!!

 

[zag]

Should I be installing this on the domain controller?

 

Also what active directory field am I looking to match it with?

 

Will we be able to use it if our "User Login Name" is different than our email address in AD? Unfortunately our login names use our old .sch.uk addresses

Edited June 4, 2013 by zag

[AngryTechnician]

It can be installed on a member server. I think you should avoid doing it on a DC since DirSync includes an SQL Server instance, and Microsoft recommend not installing SQL Server on a DC.

 

It will match on the userPrincipalName attribute, which as you probably know is a combination of the user logon name and suffix as shown at the top of the Account tab of Active Directory Users & Computers.

 

Ours didn't match originally either, but if you add the UPN suffix that you use on O365 as an alternate in Active Directory Domains and Trusts, you can then assign the 'correct' UPN suffix to users as needed. This should have no side-effects to any on-premises system, unless you have a third party system with shonky AD coding that doesn't read assigned UPN suffixes correctly.

Edited June 4, 2013 by AngryTechnician

[MicrodigitUK]

Since I know this is a feature close to the hearts of many of you, I thought I'd share this:

 

Synchronising passwords with Office 365 - UK Education Cloud Blog - Site Home - MSDN Blogs

 

Excellent news. About time and thanks for posting update on edugeek. Shame this wasn't ready last week when lots of people started live@edu migrations in the holidays.

 

All we need now is the old live@edu 4.5 SSO kit extended for new Office365 customers and small schools (that can't do ADFS) will have a full solution. What are the possibilitys of that @jamesbmarshall ?

 

It's a shame 4.5 SSO kit was only extended to December 2014. So still need to move to ADFS at some point before then. Mabey with a bit of luck Microsoft will extend that support and add in support for new educational 365 customers.

 

Never say never.

[jamesbmarshall]

Never say never.

 

Indeed.

[pantscat]

Cool... does this negate the need for ADFS then?!

[AngryTechnician]

That depends on your needs. The main thing it doesn't get you is the ability to be automatically logged in to cloud services when logged in to an on-premises workstation (true SSO). ADFS can do that.

[pantscat]

Ok - that's very interesting, thanks.

 

Still trying to work out how/what I need to do to approach our requirements - but I think that's better placed in a new thread!

[zag]

Basically...

 

If you want to create users manually -> Use the Office 365 online Portal

 

If you want to manually batch import users -> Export an OU to csv and import online

 

If you want to automatically sync your AD with Office 365 -> DirSync

 

If you want to automatically login a user without typing in their user credentials -> ADFS

Edited June 6, 2013 by zag

[ozydave]

Hello

Just setting this up. Running the config wizard I get an error 'can't communicate' I know I an using the correct login. I am guessing its firewall related!

 

Anyone know what ports this uses?

 

Cheers

[AngryTechnician]

Pretty sure it's just HTTPS 443.

 

Is the server behind a proxy? If so, check your proxy logs for entries from the server's IP and see what it tells you. You may need to define an authentication exception.

[plexer]

Can you decide who uses dirsync i.e for testing restrict it to certain users?

 

Ben

[jamesbmarshall]

Can you decide who uses dirsync i.e for testing restrict it to certain users?

 

You can scope by AD OU

 

Just be careful... if you move a user who was sync'd into an OU that's not sync'd then that will cause the Office 365 object to get deleted.

[ozydave]

Pretty sure it's just HTTPS 443.

 

Is the server behind a proxy? If so, check your proxy logs for entries from the server's IP and see what it tells you. You may need to define an authentication exception.

 

Cheers

I suppose it also helps if I was not a numpty. I hadn't activated dirsync on 365 control panel!!

[Guest Guest]

Cheers

I suppose it also helps if I was not a numpty. I hadn't activated dirsync on 365 control panel!!

 

Says it can take 24 hours but I activated it today and an hour or so later it was done.

[IT-Tom]

You can scope by AD OU

 

Just be careful... if you move a user who was sync'd into an OU that's not sync'd then that will cause the Office 365 object to get deleted.

 

How do I specify by OU?

[jamesbmarshall]

How do I specify by OU?

 

I hate to pull out LMBTFY, but here goes!

 

Let me Bing that for you!

 

Configuring the management agent is a simple, but potentially dangerous process. It goes without saying: don't be tempted to fiddle with your production environment otherwise you could end up deleting users by accident or altering the way the MA works into non-supportable state!

 

When you move an object into an OU that isn't synchronised by DirSync it will process the object as a deletion in Azure AD meaning you could lose data.

 

Hope that helps!

[Speculator]

Hi all,

 

Just got this up and running myself. It's not bad, although markedly more convoluted that the Google Apps equivalent (however it does work a little better by not requiring password resets). It's nice that they have an equivalent at all I guess. Setting up AD FS was never something that excited me, but as Microsoft pointed out (I can't remember where, sorry). AD FS is true SSO, whereas this is "same sign-on". I'd imagine that if you want your clients to be able to fire up and logon automatically you're going to need AD FS.

 

Anyway, it's there and it seems to work. It's a shame they couldn't have added in some sensible way to license users automatically though.

 

L8r.

[Simcfc73]

Bit stuck, rooting round the internet for SIP and TXT advise. Do these need setting on the internets DNS that hosts my domain name?

[Simcfc73]

Think its to do when I set up ADFS previously. Really wish it was as easy as Googles.

[Boredguy]

Bit stuck, rooting round the internet for SIP and TXT advise. Do these need setting on the internets DNS that hosts my domain name?

[ATTACH=CONFIG]18651[/ATTACH]

 

Yes it should be on your internet DNS (in our case the one held by SWGfL) and internally if you have any reference to the same domain name (which we do for seemless redirecting of the FQDN to the local IP instead of traffic going out and back in again)