Azure AD connect - thoughts?

[MYK-IT]

Quick update since last post…

 

I have since built a Windows 2016 Server (VM), installed and configure Azure AD Connect Client (following combination of suggestions here, and online install guides).

 

Following @3s-gtech advice, I have changed over the UPNs of our AD Accounts (from .local domain) to using ADModify.NET (Great tool by the way!)

 

Although our AD UPN names now end in (as per our registered domain name in Office 365) the entire AD UPN name is still not the same as their email address (e.g. UPN is @ whereas email is @) So during the configuration of Azure AD Connect I had to synch using schema/value as the unique identifier (Note to myself... when creating new Local AD User Accounts in future I would have to ensure that schema value is created).

 

To test Azure AD Connect, I choose a local OU (plus User accounts had to be member of a specific security group – This was just me being over cautious, to ensure only my test accounts synchronized.) The test accounts synchronized OK and Azure AD User accounts created! Result!

 

I then tested with password sync; which worked albeit realising that the password change / sync interview wasn’t instant… but at least I have option to decide whether to sync local AD passwords with their email accounts, or not. I realise that write back (so that users can change their O365 Email passwords themselves) is not a function that works unless we pay, and sign up to Azure AD Premium. Therefore, would I still be correct in stating that users who have forgotten their (O365 Email) password would still involve the Global Administrators receiving an email to reset their password? Regardless if password is synced or not?

 

So more Azure / O365 Noob questions….

Azure AD Connect is simply a process of synchronizing local AD accounts without the need to manually/import the same accounts again in Azure/Office 365?

Although accounts are in Azure AD Connect, an additional process (manually, script, PowerShell etc.?) would then required to be executed to assign those Azure AD accounts with O365 subscriptions (O365 ProPlus, Exchange, SharePoint etc.). So perhaps synching/importing an additional field (like year group, student, staff etc.) would be beneficial to identify and run scripts against?

All our current Staff are within O365; as their (email) accounts were created long time ago, manually. What would happen as, and when I include the Staff OU within the Azure AD Connect sync? Would they be synced OK (as would be using email address as unique identifier) or duplicate accounts created?

What happens when (local) AD accounts are disabled, moved (to another OU) and / or deleted?

 

This is all preparation for setting up Student accounts (for O365 usage) in the future (as there are a lot more students than staff, obviously) so:

 

How are student (O365) accounts setup in your schools?

Do you use same domain (e.g. @.com or student..com) or sub-domain?
Intention would be for the students to have their local UPN account name as their email address (but as mentioned, Staff aren’t so I would have to continue syncing based on schema field).
Sub-domain would create a separate global address book, and would be easier to setup mailbox (transport) rules (e.g. internal only emails, restrict etc.)

 

OneDriver Mapper

Managed to get this working on a test-lab computer. Still early days, but looking promising.

 

OneDrive Migrator

I have also managed to get this working, and I have started using it to bulk-upload data from staff user areas (as and when required). Will definitely save us time!

 

School Data Sync

I am not quite there yet, taking it one-step at a time. However, I have a support call with Microsoft, and they are arranging a time to help me set this up. Although I am still trying to understand how it will all synchronize… SIMS Data <> Local AD <> Azure AD especially as our Local AD accounts do not have unique identifiers between (itself and) SIMS etc. besides forename / last name.

 

Thanks,

[mlunn82]

Thank you for the information. I am also in the process of looking to migrate my school to O365 mainly for the storage Microsoft give us with back up and more assailable which will save the school money and on local servers and DR.

I have been reading everything and just wanted to get something clear in my head as we use LGFL Staffmail and want to carry on using LGFL staff mail - .lgflmail.org domain and also the alias School.sch.uk .

Have to have SSO working for the staff too.

Can i set up O365 to use the subdomain say 365.school.sch.uk and disable email access on 365 so the staff don't get confused and carry on using LGFL Staffmail. Once then the staff are happy with 365 and sharepoint we could look to maybe mirgrate the email over to 365 but the staff use lgflmail.org as email address which we can't take.

Hope that makes sense. So i would use 365.school.sch.uk as the UPN but have email disable. Would that still work?

Also can you use the GP and drive mappings to map the sharepoint drive or do you have to use sripts now?

 

Thanks in advance

 

Mark

[3s-gtech]

Therefore, would I still be correct in stating that users who have forgotten their (O365 Email) password would still involve the Global Administrators receiving an email to reset their password? Regardless if password is synced or not?

 

You should only need to change their AD password. If you have it synced correctly, their password for AD and O365 is the same and synced. If writeback isn't configured, it shouldn't let you change the O365 password at all, and if it does it should overwrite on next sync.

 

Azure AD Connect is simply a process of synchronizing local AD accounts without the need to manually/import the same accounts again in Azure/Office 365?

Although accounts are in Azure AD Connect, an additional process (manually, script, PowerShell etc.?) would then required to be executed to assign those Azure AD accounts with O365 subscriptions (O365 ProPlus, Exchange, SharePoint etc.). So perhaps synching/importing an additional field (like year group, student, staff etc.) would be beneficial to identify and run scripts against?

All our current Staff are within O365; as their (email) accounts were created long time ago, manually. What would happen as, and when I include the Staff OU within the Azure AD Connect sync? Would they be synced OK (as would be using email address as unique identifier) or duplicate accounts created?

What happens when (local) AD accounts are disabled, moved (to another OU) and / or deleted?

 

1) Yup.

2) Yup. Powershell (can be scheduled) or doing it manually, one at a time!

3) It should sync and merge any existing accounts that match. That's what ours did with a few existing (pre-AAD Connect) accounts.

4) Disabled - should show as disabled in the portal. Moved - shouldn't matter so long as they're still in synced OUs (otherwise they'll be deleted). Deleted - bye bye from Azure too.

 

 

How are student (O365) accounts setup in your schools?

Do you use same domain (e.g. @.com or student..com) or sub-domain?
Intention would be for the students to have their local UPN account name as their email address (but as mentioned, Staff aren’t so I would have to continue syncing based on schema field).
Sub-domain would create a separate global address book, and would be easier to setup mailbox (transport) rules (e.g. internal only emails, restrict etc.)

 

1) AADC.

2) We use the domains that we have access to, and control of DNS. That could be any that are bought or existing. That should always include @.sch.uk, but could be others if you've bought them.

[JackT]

Quick update since last post…

 

I have since built a Windows 2016 Server (VM), installed and configure Azure AD Connect Client (following combination of suggestions here, and online install guides).

 

Following @3s-gtech advice, I have changed over the UPNs of our AD Accounts (from .local domain) to using ADModify.NET (Great tool by the way!)

 

Although our AD UPN names now end in (as per our registered domain name in Office 365) the entire AD UPN name is still not the same as their email address (e.g. UPN is @ whereas email is @) So during the configuration of Azure AD Connect I had to synch using schema/value as the unique identifier (Note to myself... when creating new Local AD User Accounts in future I would have to ensure that schema value is created).

 

To test Azure AD Connect, I choose a local OU (plus User accounts had to be member of a specific security group – This was just me being over cautious, to ensure only my test accounts synchronized.) The test accounts synchronized OK and Azure AD User accounts created! Result!

 

I then tested with password sync; which worked albeit realising that the password change / sync interview wasn’t instant… but at least I have option to decide whether to sync local AD passwords with their email accounts, or not. I realise that write back (so that users can change their O365 Email passwords themselves) is not a function that works unless we pay, and sign up to Azure AD Premium. Therefore, would I still be correct in stating that users who have forgotten their (O365 Email) password would still involve the Global Administrators receiving an email to reset their password? Regardless if password is synced or not?

 

So more Azure / O365 Noob questions….

• Azure AD Connect is simply a process of synchronizing local AD accounts without the need to manually/import the same accounts again in Azure/Office 365?
  

 

• Although accounts are in Azure AD Connect, an additional process (manually, script, PowerShell etc.?) would then required to be executed to assign those Azure AD accounts with O365 subscriptions (O365 ProPlus, Exchange, SharePoint etc.). So perhaps synching/importing an additional field (like year group, student, staff etc.) would be beneficial to identify and run scripts against?
  

 

• All our current Staff are within O365; as their (email) accounts were created long time ago, manually. What would happen as, and when I include the Staff OU within the Azure AD Connect sync? Would they be synced OK (as would be using email address as unique identifier) or duplicate accounts created?
  

 

• What happens when (local) AD accounts are disabled, moved (to another OU) and / or deleted?
  

 

This is all preparation for setting up Student accounts (for O365 usage) in the future (as there are a lot more students than staff, obviously) so:

 

• How are student (O365) accounts setup in your schools?
  

 

• Do you use same domain (e.g. @.com or student..com) or sub-domain?
  Intention would be for the students to have their local UPN account name as their email address (but as mentioned, Staff aren’t so I would have to continue syncing based on schema field).
  Sub-domain would create a separate global address book, and would be easier to setup mailbox (transport) rules (e.g. internal only emails, restrict etc.)
  

 

OneDriver Mapper

Managed to get this working on a test-lab computer. Still early days, but looking promising.

 

OneDrive Migrator

I have also managed to get this working, and I have started using it to bulk-upload data from staff user areas (as and when required). Will definitely save us time!

 

School Data Sync

I am not quite there yet, taking it one-step at a time. However, I have a support call with Microsoft, and they are arranging a time to help me set this up. Although I am still trying to understand how it will all synchronize… SIMS Data <> Local AD <> Azure AD especially as our Local AD accounts do not have unique identifiers between (itself and) SIMS etc. besides forename / last name.

 

Thanks,

 

How did u manage to get the OneDrive mapper to work?

 

We've been using SSO via the ADConncet but so far have been unable to get it to work. We can see its signing into the portal just fine but access is being denied for the mapped drive with error 224 even though its in the trusted internet zones.

[MYK-IT]

Hi @mlunn82

 

Although still working through it myself, but as long as you (or LEA?) have access to manage your domain there is nothing stopping you registering that domain within your Office 365 Tenancy.

 

You can then decide which Office Licences to offer to you students / staff; even omitting the email/exchange facilities totally (which of course you can migrate across, as and when the time is suitable).

 

For example:

 

Office 365 ProPlus - would allow students / staff to download Office 2016 on up to 5 devices, free!

Office Online for Education - would allow users to use online versions of MS Word, Excel, PowerPoint & OneDrive
(You would have to enable SharePoint Plan 1 for EDU too for OneDrive)

Exchange Online (Plan 1) - would enable email access, connectivity

 

Office 365 has so many features (which appear to be added daily/weekly) and I am sure other Edugeek'ers will contribute and help who are using it more comprehensively! or did an email migration (which we didn't).

Edited February 8, 2017 by MYK-IT

[MYK-IT]

How did u manage to get the OneDrive mapper to work?

 

We've been using SSO via the ADConncet but so far have been unable to get it to work. We can see its signing into the portal just fine but access is being denied for the mapped drive with error 224 even though its in the trusted internet zones.

 

Hi @JackT

 

Been a few days since I last had chance to continue 'testing' on Lab PC, but I created GPO which:

 

Assign https://login.microsoftonline.com to Trusted Internet Zone

Ran Logon Script
%SystemRoot%\System32\WindowsPowerShell\v1.0\PowerShell.exe -ExecutionPolicy ByPass -WindowStyle Hidden -File OneDriveMapper.ps1
 
The PowerShell script was configured to suit, changing variables within the #Configuration area of the script

 

Must admit, first time logging in I had to enter password (at prompt). But at the time I was changing so many settings (within Azure AD sync), being impatient waiting for password sych to happen plus I've not had chance to revisit / test further as getting Azure AD Connect (and learning how to automate the next stage of assigning licences etc) working is priority at the moment.

[JackT]

Hi @JackT

 

Been a few days since I last had chance to continue 'testing' on Lab PC, but I created GPO which:

 

• Assign https://login.microsoftonline.com to Trusted Internet Zone
  

 

• Ran Logon Script
  %SystemRoot%\System32\WindowsPowerShell\v1.0\PowerShell.exe -ExecutionPolicy ByPass -WindowStyle Hidden -File OneDriveMapper.ps1
   
  The PowerShell script was configured to suit, changing variables within the #Configuration area of the script
  

 

Must admit, first time logging in I had to enter password (at prompt). But at the time I was changing so many settings (within Azure AD sync), being impatient waiting for password sych to happen plus I've not had chance to revisit / test further as getting Azure AD Connect (and learning how to automate the next stage of assigning licences etc) working is priority at the moment.

Ah, ok. So if you've entered the password then SSO failed, which i got it to map the drive for myself as well if i manually entered the password. But that's using a cached token held within App data so i suppose if you had %appdata% redirected to a server and had it full down that token you should be fine.

 

If you try to use SSO with AD Connect with OneDrive mapper it fails to map the drive.

[mlunn82]

Thanks for the information, i am still in testing at the moment and waiting for Microsoft to give me full version on my 365 for more testing. Have you been setting up and doing all your self? I will look at setting up that sub domain as think want to get all data and staff use to using office 365 before looking at doing the mail if get the go ahead. Would look at doing that in the summer if this works well and get LGFL to put forwarders on the lgflmail.org domain.

 

I am playing around with one drive mapper and have got it mapping home and one share point drive but can't get it to map more than one sharepoint drive.

 

Any help or tips i am doing wrong to map 3 share point drives to letters please?

 

Thanks

 

Hi @mlunn82

 

Although still working through it myself, but as long as you (or LEA?) have access to manage your domain there is nothing stopping you registering that domain within your Office 365 Tenancy.

 

You can then decide which Office Licences to offer to you students / staff; even omitting the email/exchange facilities totally (which of course you can migrate across, as and when the time is suitable).

 

For example:

 

• Office 365 ProPlus - would allow students / staff to download Office 2016 on up to 5 devices, free!
  

 

• Office Online for Education - would allow users to use online versions of MS Word, Excel, PowerPoint & OneDrive
  (You would have to enable SharePoint Plan 1 for EDU too for OneDrive)
  

 

• Exchange Online (Plan 1) - would enable email access, connectivity
  

 

Office 365 has so many features (which appear to be added daily/weekly) and I am sure other Edugeek'ers will contribute and help who are using it more comprehensively! or did an email migration (which we didn't).

[mlunn82]

Hi MYK-IT,

 

I have been looking at OneDriver Mapper and have got it working to map one drive and 1 sharepoint drive but can not get it to map any more. I.e a Y: say staff but can't get a P: or M: drive to map but if take P: away and change to M: it works. can't get more than one drive to map. I must be doing something wrong in the script.

 

Are you able to help please?

 

Thanks

 

Quick update since last post…

 

I have since built a Windows 2016 Server (VM), installed and configure Azure AD Connect Client (following combination of suggestions here, and online install guides).

 

Following @3s-gtech advice, I have changed over the UPNs of our AD Accounts (from .local domain) to using ADModify.NET (Great tool by the way!)

 

Although our AD UPN names now end in (as per our registered domain name in Office 365) the entire AD UPN name is still not the same as their email address (e.g. UPN is @ whereas email is @) So during the configuration of Azure AD Connect I had to synch using schema/value as the unique identifier (Note to myself... when creating new Local AD User Accounts in future I would have to ensure that schema value is created).

 

To test Azure AD Connect, I choose a local OU (plus User accounts had to be member of a specific security group – This was just me being over cautious, to ensure only my test accounts synchronized.) The test accounts synchronized OK and Azure AD User accounts created! Result!

 

I then tested with password sync; which worked albeit realising that the password change / sync interview wasn’t instant… but at least I have option to decide whether to sync local AD passwords with their email accounts, or not. I realise that write back (so that users can change their O365 Email passwords themselves) is not a function that works unless we pay, and sign up to Azure AD Premium. Therefore, would I still be correct in stating that users who have forgotten their (O365 Email) password would still involve the Global Administrators receiving an email to reset their password? Regardless if password is synced or not?

 

So more Azure / O365 Noob questions….

• Azure AD Connect is simply a process of synchronizing local AD accounts without the need to manually/import the same accounts again in Azure/Office 365?
  

 

• Although accounts are in Azure AD Connect, an additional process (manually, script, PowerShell etc.?) would then required to be executed to assign those Azure AD accounts with O365 subscriptions (O365 ProPlus, Exchange, SharePoint etc.). So perhaps synching/importing an additional field (like year group, student, staff etc.) would be beneficial to identify and run scripts against?
  

 

• All our current Staff are within O365; as their (email) accounts were created long time ago, manually. What would happen as, and when I include the Staff OU within the Azure AD Connect sync? Would they be synced OK (as would be using email address as unique identifier) or duplicate accounts created?
  

 

• What happens when (local) AD accounts are disabled, moved (to another OU) and / or deleted?
  

 

This is all preparation for setting up Student accounts (for O365 usage) in the future (as there are a lot more students than staff, obviously) so:

 

• How are student (O365) accounts setup in your schools?
  

 

• Do you use same domain (e.g. @.com or student..com) or sub-domain?
  Intention would be for the students to have their local UPN account name as their email address (but as mentioned, Staff aren’t so I would have to continue syncing based on schema field).
  Sub-domain would create a separate global address book, and would be easier to setup mailbox (transport) rules (e.g. internal only emails, restrict etc.)
  

 

OneDriver Mapper

Managed to get this working on a test-lab computer. Still early days, but looking promising.

 

OneDrive Migrator

I have also managed to get this working, and I have started using it to bulk-upload data from staff user areas (as and when required). Will definitely save us time!

 

School Data Sync

I am not quite there yet, taking it one-step at a time. However, I have a support call with Microsoft, and they are arranging a time to help me set this up. Although I am still trying to understand how it will all synchronize… SIMS Data <> Local AD <> Azure AD especially as our Local AD accounts do not have unique identifiers between (itself and) SIMS etc. besides forename / last name.

 

Thanks,

[zag]

Just for info, you can change the Active Directory UPN name for multiple users by just selecting all the accounts and then hitting properties.

 

Then just click on the "Account" tab and change the UPN suffix for as many uses are you have selected.

 

This works with a few Active Directory features and is a nice little trick.

 

Just make sure you don't include any groups in the selection otherwise it won't work.

[snagrat]

Just for info, you can change the Active Directory UPN name for multiple users by just selecting all the accounts and then hitting properties.

 

Then just click on the "Account" tab and change the UPN suffix for as many uses are you have selected.

 

This works with a few Active Directory features and is a nice little trick.

 

Just make sure you don't include any groups in the selection otherwise it won't work.

 

Or through Powershell.

 

I have a script that copies the SAMAccount and duplicates it into the UPN field and sets the correct domain.

 

Some of our very older systems have the UPN missing completely so selecting through bulk in the AD gui does not work

[DavePa]

Thanks to all that have contributed ideas and suggestions, as usual I've learnt new things which is always good think we have finally cracked it so the email address does not become a domain.onmicrosoft.com one and if so it's a nice and simple fix and could well be something I missed in the instructions, all we have done is to add the desired email address within the AD properties and so far the 2 accounts that we have changed have retained the correct email address. I'll create a couple more dummy accounts this morning but so far looking good

[jonspurs]

Hi,

Looking to set this up.

How does AD Connect work with subdomains?

Eg, we have UPNs added - school.sch.uk and students.school.sch.uk

So say if I bulk update an OU of student users to "students.school.sch.uk" and bulk update an OU of staff to "school.sch.uk", will it just work without errors?

 

Also, does the UPN have to change? What if we bulk update the 'mail' attribute of users accordingly instead? I saw in a video that under 'Customise' you can change the 'on-premises attribute'.

 

Cheers,

Jon

[3s-gtech]

It works lovely with parent and child domains (we have the same). As long as the UPN Suffixes (not the UPN, leave that be) are set the same for all, it can traverse between the domain levels (so long as your two way trusts are spot-on). You really do need to change it though, the mail attribute is just informational and for certain applications like Exchange (I believe).

[jonspurs]

Thanks for your reply.

Sorry, yes I meant UPN suffixes :-)

Probably a basic question - but what do you mean by two way trusts?

 

Cheers,

Jon

[3s-gtech]

Trusts are the links between domains, set up in Domains and Trusts. I'd imagine they're absolutely sorted - in schools where admin and student domains used to be separate, trusts brought them together when the thinking changed. Allows users to log on across domains, administrators to manage both etc etc.

[jonspurs]

Ah ok, thanks for explaining. I should have been clearer - we only have one 'Windows' domain (school.internal), but 2 domains in Google - eg for staff it's @school.sch.uk and students is @students.school.sch.uk - so I've added those UPN suffixes to AD.