O365 not syncing passwords

[gareththomas21]

Hello,

We migrated our emails from Exchange 2003 to Office 365 last year and everything was running fine whilst our old exchange server was still running. Students and staff passwords were being synchronised from local AD so they only had one password to manage and everyone was happy!

 

Recently we have removed our old exchange server from the network and whilst the bulk of our users have not even noticed, all of our Year 7 pupils are now being asked to change their passwords on O365 independently from AD. This has resulted in a lot of confusion, particularly as it's the younger students being requested to do this. I have checked their users in the Admin section of 365 and it says "Synced with Active Directory" but nevertheless it insists that their passwords are not synced. I have also checked the sync settings on dirsync and upgraded to the latest version and still it doesn't work.

 

Has anyone else experienced this? I could really do with some help as I had very little to do with the migration and have had no training, yet I am now the most senior person employed now and it's left to me to sort out.

[dapaulio]

We still have onsite exchange so couldnot tell you whether you are one of many people suffering this problem however O365 currently has an incident number that engineers are currently investigating relating to exchange online services and features. It was only raised within the last hour but may be related.

 

It may be worth holding back trying anything until they resolve their issue.

 

Things you could check are

Is the ou checked in connectors in sync service manager where your year 7 pupils reside

 

If you change another pupils password that you know that works in ad and force a sync. Can you log on to that account with that reset password

 

I assume if you reset the password on the yr 7 account in O365 it works then?

[win]

when removing the old exchange server did you first convert the mailboxes to MEUs?

[gareththomas21]

No this wasn't done before hand. I may have mislead the point a bit without realising it but our Year 7s never had accounts on our old exchange server they were setup on 365 only through adding the email address to the email field in AD. The reason I mention the exchange server is that this seemed to start happening around the time that it was decommisioned. Year 8 and upwards all seem to be fine though, as do staff including those staff that have only been setup on 365.

[gareththomas21]

No this wasn't done before hand. I may have mislead the point a bit without realising it but our Year 7s never had accounts on our old exchange server they were setup on 365 only through adding the email address to the email field in AD. The reason I mention the exchange server is that this seemed to start happening around the time that it was decommisioned. Year 8 and upwards all seem to be fine though, as do staff including those staff that have only been setup on 365. Also, slightly worryingly, none of my users appear to have anything in their proxyaddresses field in AD. Should I be worried by this?

[sparkeh]

No this wasn't done before hand. I may have mislead the point a bit without realising it but our Year 7s never had accounts on our old exchange server they were setup on 365 only through adding the email address to the email field in AD. The reason I mention the exchange server is that this seemed to start happening around the time that it was decommisioned. Year 8 and upwards all seem to be fine though, as do staff including those staff that have only been setup on 365. Also, slightly worryingly, none of my users appear to have anything in their proxyaddresses field in AD. Should I be worried by this?

Hmm i would expect to see their addresses in the proxy field for sure.

[gareththomas21]

That's exactly what I thought. But i still don't see how that would affect only the year 7 students.

[truebluesteve]

Are there an errors in the event logs of the server that dirsync is installed on?

[gareththomas21]

Ok, not certain yet but think it was the proxyaddresses problem. Unsure why it is not causing the same problem with everyone but I have just run a test with a fake Y7 account. Nothing in proxyaddresses, reset password using AD, couldn't logon to OWA, added email address to proxy addresses, allowed me to logon with new password. Further testing required but feels like progress!!

[gareththomas21]

Ok, so it wasn't the proxyaddresses thing. I have been doing a bit of digging and discovered that the GUIDs for the two accounts (Local and Azure AD) are different which is why it is not updating passwords. I'm not sure how this happened but I believe it is related to the fact that these students had their names misspelt when they were first entered onto Local AD and then corrected on Local AD and username corrected on 365 using the following powershell command:

 

"set-msoluserprincipalname -userprincipalname [OLD EMAIL ADDRESS] -newuserprincipalname [NEW EMAIL ADDRESS]"

 

Anyway, my problem is now this, can I get these two user accounts to link up without having to delete the user account and create it again from scratch? From what I've read so far it isn't possible but I'm just wondering if anyone else has found a way around it?

[iamLeon]

Gareth - why not federate, then there's only one password anyway? Plenty of cloud-based providers that can take care of this issue for you edu.iamcloud.com / www.onelogin.com / www.okta.com etc