DirSync Office365 Mailbox Issue

[phughes]

Hi all,

 

I have setup DirSync and was happy to find all of my users and groups on the Office365 admin page. I have now tried to license a user with Online Exchange and receive the following message;

 

"This user's on-premises mailbox has not been migrated to Exchange Online. The Exchange Online mailbox will be available once migration is completed"

 

This only happens for users that have been synced using DirSync as they are mail enabled with on premises exchange. I do not however want to migrate mailboxes and would like to start a fresh.

 

Anyone know how to get around this?

[AngryTechnician]

Reading through this thread (DirSync without Coexistence? [sOLVED] | Directory integration services | Microsoft Office 365 Community), what you've described is expected behaviour for DirSync when you have on-premises Exchange. The presence of the msExchMailboxGuid is synced to Azure and Office 365 won't create new mailboxes for accounts that have it.

 

The workaround appears to be to start again by turning off DirSync, deleting the synced users, and provisioning them manually (or using CSV upload). Once you've given them an Exchange licence in O365 you can then turn DirSync back on and their on-premises accounts will be soft-matched to the pre-created O365 account. See the verified answer by TSmith on the above thread.

[FN-GM]

You could disable to sync of the msExchMailboxGuid attribute.

[phughes]

Thank you for your response. I will give that a go.

[phughes]

You could disable to sync of the msExchMailboxGuid attribute.

 

Ooooo, sounds promising..... how?

[phughes]

OK, I unchecked the attribute on the MIISclient for the sync from my AD and received this error.

 

 

I then went into the mailflow settings and had to delete it from this under user.

 

 

Is this how you'd do it?

 

If so, I will presumably need to remove my o365 users and re-sync, as this attribute will exist for the users created previously and will not remove the attribute for me. Just not sync it.

 

When deleting users on o365, it moves them into "deleted users" and I cant see a permanent delete option? I don't really want to have to wait 30 days before they completely disappear before re-syncing.

Edited March 12, 2014 by phughes

[FN-GM]

If so, I will presumably need to remove my o365 users and re-sync, as this attribute will exist for the users created previously and will not remove the attribute for me. Just not sync it.

 

When deleting users on o365, it moves them into "deleted users" and I cant see a permanent delete option? I don't really want to have to wait 30 days before they completely disappear before re-syncing.

 

If you delete and resync it will just make the accounts active again and won't do what you want.

 

This guide is pretty good for doing what you want - Create Office 365 mailboxes while On Premise mailbox still exists

[EduTech]

Hi,

 

I will strongly advise you NOT to make any changes to the Directory Sync Management Agents apart from what is mentioned in the following Article for Filtering Purposes: Configure filtering for directory synchronization

 

The reason you are getting that message is because your users have an ON-PREMISE mailbox or so it seems, if you want to migrate that to Exchange Online then please follow the supported migration methods. If you do not require the mailbox, then please Disconnect the mailbox from the User Object to ensure that the User Object Exchange Attribute Values are then removed which will then allow you to provision an Exchange Online Mailbox.

 

If you need any further assistance, I advise you open a Support Case with Microsoft.

 

*note: please ensure that you revert any changes to the Directory Sync Tool MA to Default so that your infrastructure is in a supported state.

 

Hope that helps,

 

James.

[snagrat]

I've done this before and hit the same problems as you.

 

You need to disable dirsync first.

 

Then You have to delete the users and then use powershell to purge the deleted users.

 

Then edit the MIIS so the MSExchangeMailboxGUID does not sync

 

Then re-enable dirsync.

 

This worked for me. I don't see any issues modifying MIIS as long as you know what fields do what.

[EduTech]

I've done this before and hit the same problems as you.

 

You need to disable dirsync first.

 

Then You have to delete the users and then use powershell to purge the deleted users.

 

Then edit the MIIS so the MSExchangeMailboxGUID does not sync

 

Then re-enable dirsync.

 

This worked for me. I don't see any issues modifying MIIS as long as you know what fields do what.

 

The issue is that it is not supported to make any changes to Directory Sync (MIIS) apart from what is mentioned, If you want to make changes then use Forefront Identity Manager.

..... There are reasons why, this is the case and these reasons may not be 'technical' what you do may work... but none of these changes {i.e. non-supported changes} are taken into account during Product Updates! :-)

 

James.

[FN-GM]

@EduTech has a very good point. If you are insistent in doing this make sure its only short term and that you have tested and tested.

[EduTech]

Furthermore, I just want to add that in terms of your problem that you are having there is a perfect technical explanation and what you are seeing is by design, if you want to provision mailboxes in Exchange Online then first make the decision as to weather the On-Premise mailbox that this user has currently is actually required, if not then remove the attribute values in the supported way and that is to disconnect the mailbox using the Exchange Management Console.

 

If the user is actually using the mailbox, then you should want to Migrate this in the correct way... if you are not looking to migrate then the answer still stands that you should Disconnect the mailbox.

 

If you are trying to go through a Proof of Concept then you should use TEST accounts in order to achieve.

 

I also want to point out that, the Windows Azure Directory Sync Tool is a 'Lightweight Version' of Forefront Identity Manager and so if you are to launch the MIIS Client it will pretty much look like FIM but any changes other than those specified in the TechNet articles provided are unsupported and should NOT be implemented, further more you are technically doing things that you possibly also won't be licensed for in terms of Product use never mind reviewing the issue in terms of sustainability should you go and upgrade to the latest version.

 

The Windows Azure Directory Sync Tool receives updates on a regular basis, watch out for these as sometimes we release new features that may or may not meet your future requirements. In terms of answering this thread, please review my comments above and understand the reason why you are having 'such error' appear and also understand that what you are seeing is by design based on what is configured in each of the user accounts that have this error.

 

Happy to discuss this further, and hope it answers your question :-)

 

Cheers,

James.

[phughes]

Hi Guys,

 

Really appreciate your input on this. Don't worry EduTech I always ensure I can revert back and use test accounts.

 

This change is only temporary while I get both on-premises and cloud exchange running, so I can get accounts setup and ready to go before I change MX records and disconnect mailboxes.

 

FN-GM - looks like exactly what I need. I'll try it out and give you thanks if this is my solution

[EduTech]

Hi Guys,

 

Really appreciate your input on this. Don't worry EduTech I always ensure I can revert back and use test accounts.

 

This change is only temporary while I get both on-premises and cloud exchange running, so I can get accounts setup and ready to go before I change MX records and disconnect mailboxes.

 

FN-GM - looks like exactly what I need. I'll try it out and give you thanks if this is my solution

 

If I was you, remove all of the user accounts from azure ad, consider creating the user accounts using CSV upload and then you can implement directory sync at a later date. {this is providing your not looking to migrate any data}

 

James.

Edited March 13, 2014 by EduTech

[phughes]

If you want to make changes then use Forefront Identity Manager

 

If this is a better method to achieve what I need, please elaborate?

[phughes]

If I was you, remove all of the user accounts from azure ad, consider creating the user accounts using CSV upload and then you can implement directory sync at a later date. {this is providing your not looking to migrate any data}

 

Then soft-match them with UPN when up and running, to provide password sync?

 

When I have disconnected my mailboxes on-premises and removed exchange. Presumably my distribution lists and contacts would no longer sync anyway as they wouldn't be mail enabled? So I'll have to set these up manually to be displayed in "people" and "directory"?