O365 DirSyn - Group membership not updating

[Trapper]

Anyone come across this?

 

Bit of background our SLT group was created in cloud ages ago.

 

When I ran the first full sync this morning it was updated to be synced from on prem. That's fine.

 

I noticed that one ex-SLT member was still in the AD SLT group and she still needs access to all the same shares, so it was just simpler to leave her in.

 

After the DirSync obviously she was added to the O365 SLT group.

 

Now when I remove her from the group in AD and sync - nothing changes.

 

When I try and remove her via the Exchange web console, it won't let me as the group is managed on prem.

 

I've got MS looking at it, but I'd rather get her out ASAP. It's not a major issue as she's still SLT-ish and she wouldn't tell anyone she got any emails in the interim, I'd just prefer to avoid that.

 

Any ideas?

[Steve21]

What's it say in DirSync when you do the sync? Should show the changes to any groups in logs.

 

Also how are you doing the sync? You doing it manually via Console or you using the powershell etc?

 

Steve

[Trapper]

Console and running the scheduled task.

 

The log is showing the correct members for the group, but not in cloud. It's rather bizzare.

 

All other changes I've run this morning such as user info (address, phones etc.) and additional smtp addresses have synced fine.

[Steve21]

In the "Joiner" part, search for "Filtered Disconnectors" and see if they're in there for any reason

 

Steve

[Trapper]

Nope none there

[Steve21]

And in the actual job log does it show they're added via DirSync?

 

As in Click the Updates -> Choose the Distinguished Name -> View the Modify Member Properties, and look what's been done to it

 

Steve

[Trapper]

Also run a preview of a full and delta sync of that group and the membership is fine - the same as AD so I'm assuming the issue is on the Azure side rather than on prem.

 

Well at least I didn't screw it up!

 

Funny thing is when it updated the group from cloud to AD synced it added this member of staff, who has only been back in this group a few days. Looks like it is allowing additions, but not removals.

 

Actually I'll try adding myself in from AD and sync it back...

[Trapper]

And nope not adding me either, but the connector is processing the changes....

 

[Trapper]

Righto...

 

I've created a test security group in AD with an smtp address. Added two members, synced and it appeared.

 

Removed me from it and synced and yup the changes went through.

 

Got to be a problem with this group.

 

Next idea... delete the SLT group from AD and sync and see what happens?

[Steve21]

As silly as it sounds does the group have a display name set? I know there were some bugs with that before that if it wasn't it gets upset sometimes

 

Steve

[Trapper]

Well MS have been on. They showed me the group membership in PowerShell and the user wasn't on it, so they said the replication to the web interface was taking a while.

 

Being an old hand at the old IT blagarooney I sent a test email and.... the user gets it.

[Steve21]

Haha always a fun one Oh well at least it's "working"

[Trapper]

Yeah well... bit different to be on the receiving end of an IT blag rather than giving it!

 

Just created a rule to auto-delete any emails she receives from the group for the time being.

[Steve21]

Oh so she's still getting it? :s

 

If so did you check the DisplayNames etc too? Seems it still is a "bug" https://support.microsoft.com/en-us/kb/2857349

 

Steve

[Boredguy]

Instead of running the sync via the separate tasks, have you tried running Start-OnlineCoexistenceSync from within PowerShell?

 

To start a sync, open powershell and type...

 

cd "C:\Program Files\Windows Azure Active Directory Sync"

.\DirSyncConfigShell.psc1

 

Then in new window that appears, type...

 

Start-OnlineCoexistenceSync

[Trapper]

Yeah the MS guy did that.

 

Every other group is fine. You can create, add, remove and no problems.

 

I'm starting to wonder whether it's a glitch. This group was created in cloud five years ago as part of a Live@Edu tenancy, it's been moved around, the code base has changed countless times and now it's changed to an on prem managed group. There are a lot of things that could be causing it.