Office 365 user synchronization

[Davit2005]

We have an internal ( .local ) domain that is different from the Office 365 domain, looking at DirSync and ADFS will this cause any problems with either.

 

 

With DirSync we know we can schedule the sync down to half an hour but we have 7000+ accounts that will be in Office 365 so would DirSync synchronize the whole lot or is there some intelligence only the differences since last synchronization.

[themightymrp]

Our internal domain is also a .local whereas our office 365 email domain is @schoolname.sch.uk - ADFS and Dirsync are fine in this environment.

 

In terms of the Dirsync, from what I've observed in the Forefront manager part of ADFS, it seems to just sync changes. When ours runs it seems to only take less than 30 seconds to update everything adding/removing users as needed

[EduTech]

Hi,

 

In terms of your .local domain name that is not a problem at all, you just need to remember to add your External Vanity Domain [domain.sch.uk] as an additional UPN Suffix via domain.msc and then update your users UPN accordingly.

 

Upon the initial configuration, the tool will do a FULL IMPORT FULL SYNC Run Job, after this DELTA Run Job's will complete every 3 hours and only changes/updates will be made. You can also do OU Filtering so when you implement Directory Sync uncheck the box at the end of the wizard so the the initial sync does not complete and then follow the instructions here to implement OU Filtering Configure filtering for directory synchronization

 

Then, wait your 3 hours and the FULL SYNC will run... or you can force this using the DirSyncConfig.psc1 > Start-OnlineCoexistenceSync file. :-)

 

I hope that helps,

 

James.

[Davit2005]

Our internal domain is also a .local whereas our office 365 email domain is @schoolname.sch.uk - ADFS and Dirsync are fine in this environment.

 

In terms of the Dirsync, from what I've observed in the Forefront manager part of ADFS, it seems to just sync changes. When ours runs it seems to only take less than 30 seconds to update everything adding/removing users as needed

 

Thanks for this

 

Do you use both DirSync and ADFS i.e. DirSync for Uploading new users and then ADFS for authentication?

 

Thanks again for help, I'm glad the .local won't cause problems, did you have to do anything for your internal users to get that to work i.e. DNS.

[themightymrp]

Sorry, slow reply.

 

As EduTech says above, you just need to add the second UPN suffix into your Active Directory and then update your users to use that. This is dead easy and you can highlight all users in an OU and do them in bulk. This won't affect their logons to the domain one bit.

 

I use the DirSync for uploading/synchronising users and the ADFS for authentication and single sign-on.

 

If you don't require single sign-on, you can use the newer Dirsync with PasswordSync which will synchronise their passwords into the cloud as well. This removes the need for ADFS altogether! But a password change will only take effect after the next timed sync

[sted]

Sorry, slow reply.

 

As EduTech says above, you just need to add the second UPN suffix into your Active Directory and then update your users to use that. This is dead easy and you can highlight all users in an OU and do them in bulk. This won't affect their logons to the domain one bit.

 

I use the DirSync for uploading/synchronising users and the ADFS for authentication and single sign-on.

 

If you don't require single sign-on, you can use the newer Dirsync with PasswordSync which will synchronise their passwords into the cloud as well. This removes the need for ADFS altogether! But a password change will only take effect after the next timed sync

 

can you set the sync schedule or is it fixed?

[themightymrp]

It defaults to every 3 hours but it can be customised using the instructions here:

 

Reducing the Office 365 DirSync Schedule :: Exchange Online :: Microsoft Office 365 :: Exchange Server Tips & Tricks :: KBase Tips :: MSExchange.org

[GrumbleDook]

Sorry to but in here, but can I make reference to the use of .local for an internal domain.

.local - Wikipedia, the free encyclopedia

Probably too late for you to change it but anyone who finds this thread and is building a new domain and O365 into it can people follow the standards?

[themightymrp]

Sorry to but in here, but can I make reference to the use of .local for an internal domain.

.local - Wikipedia, the free encyclopedia

Probably too late for you to change it but anyone who finds this thread and is building a new domain and O365 into it can people follow the standards?

 

It is too late for us, without doing a big do-over for the whole domain. I assume from what I'm reading in this article that we should have the domain name set to what we are going to use in Office 365? Therefore leaving only one possible UPN suffix?

[Boredguy]

Generally using anything but .local is fine, but keeping it the same, or as close as possible to your FQDN is always a good idea

[GrumbleDook]

You can use any domain really, just not one of the restricted domains (from RFC 6761 or RFC 6762).

 

I know quite a number of people who use .internal or short names to do with their business (.shop, .car, etc) ... but with domains being opened up by ICANN people are finding things like .info, .name and so on being real domains ... ... I know one museum that is having fun and games over .info with the parish council, who run a local information service. At the moment there is not a clear internal domain for production environments it is down to the Sysadmin to consider what the risks are.

 

O365 doesn't really care, to be honest, and the guide from EduTech covers that side.

[jbailey]

Just to add, Using the latest dirsync and password sync doesn't require you to wait for the cycle for password to change, the password sync is a separate process you install to dc servers, and password changes are synced "instantly".

[EduTech]

Just to add, Using the latest dirsync and password sync doesn't require you to wait for the cycle for password to change, the password sync is a separate process you install to dc servers, and password changes are synced "instantly".

 

You do not install anything on your domain controller, The password sync configuration actually is contained with the binaries of the Directory Sync Tool & the configuration like most is held within the DLL's etc. The passwords themselves are not synchronized instantly there is an upto 2 minute window for this to take place.

 

But yes, In terms of the 3 hour interval this is purely for Directory Synchronization in terms of User Objects & Values. Password Sync is done continuously and you will events being logged around every 2 min and this cannot be forced.

 

James.

[jbailey]

You do not install anything on your domain controller, The password sync configuration actually is contained with the binaries of the Directory Sync Tool & the configuration like most is held within the DLL's etc. The passwords themselves are not synchronized instantly there is an upto 2 minute window for this to take place.

 

But yes, In terms of the 3 hour interval this is purely for Directory Synchronization in terms of User Objects & Values. Password Sync is done continuously and you will events being logged around every 2 min and this cannot be forced.

 

James.

 

Oh yeah, sorry was thinking of the old live@edu password sync I had to remove.

 

(cough) bedtime... (Cough)

[themightymrp]

Useful to know!