Office 365 Azure AD Connect question

[NickDay85]

Hello,

 

We have just migrated to a new Office365 tenancy. Our old one was synced with AD, but the new one is yet to be synced. We have In Cloud users for staff and students on the new tenancy, and for speed the staff have all logged into these by changing their password, so we are managing two passwords for staff. I'm happy to do this, but doing this for students would be a nightmare.

 

In your experience, if I set up AAD connect again to the new tenancy and only SMTP match students, will the In Cloud users be unaffected? I'm planning on syncing staff at a later date, but as long as they still have access to their new accounts and the sync doesn't change their usernames to onmicrosoft then I'm happy.

 

Any advice/confirmation would be appreciated.

 

Thanks

Nick

[NickDay85]

Does anyone have experience with this?

 

Thanks

[mikkydoos]

Define "In cloud" @NickDay85

[snagrat]

When you setup AAD only set it to sync the Student OU.

 

This will mean the Staff are completely untouched and not affected

[NickDay85]

Sorry, by "In Cloud" I mean accounts that are created within O365. We want a mixed economy of both on-premised synced acccounts (students) and accounts created manually on O365 (staff) this is because I'll be unable to match AD staff to their O365 account due to username differences.

[NickDay85]

When you setup AAD only set it to sync the Student OU.

 

This will mean the Staff are completely untouched and not affected

 

They'd continue to exist on O365 with our primary domain as their username? I'm just a bit concerned that once O365 sees that we're syncing accounts from AD, it will treat the accounts that are on there already differently and change their usernames to onmicrosoft.

[mikkydoos]

Username differences shouldn't matter.

 

You can actually set up to work sync'd... which is better because managing accounts online is a pain if you have a lot.

 

As long as you have you have a UPN suffix in your forest to match your external domain you can set a property in the teachers AD account..... 'ProxyAddress' (this is where you can set a different username and domain from their AD user name).

 

As long as the users object has the correct UPN suffix selected and the correct ProxyAddress configured it should sync without creating duplicates.

[NickDay85]

Username differences shouldn't matter.

 

You can actually set up to work sync'd... which is better because managing accounts online is a pain if you have a lot.

 

As long as you have you have a UPN suffix in your forest to match your external domain you can set a property in the teachers AD account..... 'ProxyAddress' (this is where you can set a different username and domain from their AD user name).

 

As long as the users object has the correct UPN suffix selected and the correct ProxyAddress configured it should sync without creating duplicates.

 

Thanks. I'm going to not sync staff accounts just yet as they've all just reset and logged into their applications using new passwords. If I change them now there'll be bedlam. Students haven't been given new accounts yet, so if I can just sync the student OUs without affecting the staff accounts then I'm onto a winner. I've already made the changes in AD for the students so hopefully should work.

[mikkydoos]

In Azure cloud theres options to auto assign licenses too. Thats handy!

[NickDay85]

Just to update. I bit the bullet and synced the students only, and the staff did indeed stay untouched. All 1200 students had a soft-match so it's all good.

 

Thanks for your help.