Office 365 AD Sync questions

[tj2419]

Hi

 

We use office 365 and I am about to set up the AD sync option for it to sync our accounts and passwords.

 

In the steps it mentions about changing the domain for each AD account. Currently ours are network-name.internal. Will this cause any issues changing it to schoolname.sch.uk? Will it affect any permissions etc?

 

Also we use RM CC4.5. When you create accounts via the rmmc it automatically does it with the domain network-name.internal. How do I change this to the new email domain?

 

Thanks

[Cache]

It doesn't answer your question, however I have migrated from DirSync to AD Sync and still haven't setup our internal domain name to match the Office 365 tenant, I still specify the UPN in the Office 365 portal when activating the users.

 

In terms of adding the suffix to your domain, the instructions are fairly straight forward but no idea how it will impact on RMMC: https://technet.microsoft.com/en-gb/library/cc772007.aspx

[tj2419]

It doesn't answer your question, however I have migrated from DirSync to AD Sync and still haven't setup our internal domain name to match the Office 365 tenant, I still specify the UPN in the Office 365 portal when activating the users.

 

In terms of adding the suffix to your domain, the instructions are fairly straight forward but no idea how it will impact on RMMC: https://technet.microsoft.com/en-gb/library/cc772007.aspx

 

So you haven't changed the UPN and it still works?

 

Thanks

[Cache]

Yep, it works fine, it just sets them all to a .onmicrosoft.com domain (not sure whether that's because it doesn't know or whether that's just because that is my default domain in Office 365). Then when I activate and licence them I just set them to the correct UPN in the Portal (soon to be moving to a script when I finish testing it).

[FN-GM]

In the steps it mentions about changing the domain for each AD account. Currently ours are network-name.internal. Will this cause any issues changing it to schoolname.sch.uk? Will it affect any permissions etc?

 

Thanks

 

No it won't break anything like that. The permissions don't use your username to identify your account they use the GUID. This will not change

[tj2419]

I am about to finally setup dirsync. Can I just ask will it automatically link the users whose username is the same and the beginning of their email and who have the correct UPN?

 

Also for users who have different network username to the office 365 account. is there a way to manually link them? Or will it just create them a new email account?

 

Thanks

[FN-GM]

I am about to finally setup dirsync. Can I just ask will it automatically link the users whose username is the same and the beginning of their email and who have the correct UPN?

 

Yep, it will link them if both username and UPN match.

 

Also for users who have different network username to the office 365 account. is there a way to manually link them? Or will it just create them a new email account?

 

You will need to rename either the Office 365 account or AD account.

[tj2419]

It's only 5 users affected so if I ran the sync before we changed theirs would it just mean they wouldn't be synced up until their names matched? Or would it create an additional email account?

 

Thanks

[Matt_Renato]

It would create accounts in Office 365, but the mailboxes aren't created until a license is applied.

[Michael]

If you have a look here with thanks to @Matt_Renato I've created a script which will populate the ProxyAddresses attribute.

 

In addition to the above, once the UPN suffix is changed from your local domain extension to your O365 domain extension, the sync will perform correctly and users won't be allocated an onmicrosoft.com address.

 

All you need to do is allocate licenses in bulk and that's it, job done in terms of syncing/licensing.

[EduTech]

Hi,

 

I just wanted to point out a few things; If the user objects in Azure AD are Cloud Users and then at a later date you choose to setup Azure AD Connect your On-Prem Users with soft-match to the respective cloud user object providing that the On-Premise User Objects Primary SMTP address matches the Primary SMTP address of already present user object in the cloud.

 

If you used the default configuration of Azure AD Connect if any of your On-Prem Users have a UPN Suffix that is of a non-routable or non-verified domain namespace in the Azure AD Instance then by default it will use the *.onmicrosoft.com Initial Domain Name for the UPN Suffix.

 

IF you have signed up in the past 6 months~ then your Azure AD will have a feature flag added that will allow updates to the UPN to be performed even if the user has an assigned license and the UPN providing the UPN is not being changed from a Federated Domain to a Managed Domain. This in turn means; if you change your UPN on-premise to be that of a Verified Domain NameSpace during the next sync cycle the updates will be reflected in Azure AD.

 

If you do not have this feature enabled, you can now enable this via AAD Connect PowerShell Module: More Information:- https://azure.microsoft.com/en-gb/documentation/articles/active-directory-aadconnectsyncservice-features/#synchronize-userprincipalname-updates

 

By enabling this feature it means you shouldn't need to go and run scripts to correct the UPNs; The script that populates the UPN value on-prem with that of the Primary SMTP address is helpful and ideally you would want to run that prior to doing your Initial Sync to prevent any issues such as dupliace accounts being created as then things get messy. :-)

 

James.