O365 AD Directory Sync issues

[mrwoberts]

Latest AAD installed and syncing two on-prem domains.

 

I've deselected containers with security groups in, however, the O365 admin centre continues to include Security Groups, even ones I've deleted (from local AD)!!

It won't let me remove them from the cloud, warning, 'You can only manage this group in your on-premises environment. Use 'Active directory users & groups' or 'Exchange Admin Center' tools to edit or delete this group.'

 

How on earth can I make the online directory look like what it should - remove non-existing groups and no longer include security groups.

I've done a Full Import from the Synchronisation Service app but it continues to be full of junk. I didn't set this software up, but I'm trying to clean it up.

 

Would it be better to start from scratch?

Would it be better to clean things up using PowerShell (that will take some learning).

 

Kind regards

[FishCustard]

Open a PowerShell prompt on one of your DCs with the Azure Sync tool installed and run Start-ADSyncSyncCycle -Policy Initial

 

That should get things cleaned up. You'll need to do that for each domain.

[mrwoberts]

Thanks FishCustard

 

In desperation I ended up using the PowerShell commands to Remove-MsolGroup and it was remarkably easy. However, this morning...... One user has emailed from her private email to say she can no longer login to her outlook account. Odd, because I can see her there, not blocked or anything. I've reset her password and logged in fine. Hoping this is a one-off, or a Microsoft portal temporary issue.

 

Out of interest, what would the Start-ADSyncSyncCycle -Policy Initial command do? I'm looking for something along the lines of, the AD is the master, so remove any 'synced with AD' objects that actually no longer exist in AD, or have been moved to an OU that I don't want to be synced.

 

Kind regards

[kevin_lane]

Have you tried opening the azure sync tool (it's like a debugging one ) and you can perform different synchronisation i will have a look when back in the office but I remember I had to use that for something similar but for a user account instead