Powershell Sync OUs to Azure Admin Units

[ADMaster]

Hello all,

I’m working on a script to sync my OUs to Azure Adin Units.

I have the bulk of the code working, but I’m just trying to compare the OU to the AU membership, so it doesn’t try to add a user that is already there.

I’ve tried a foreach loop with -in and -contains and their not variants. I’ve also tried compare object.

 

The in and contains functions do not find the user in the array.

The compare object is telling me one user is there and another is not.

 

Here are the relevant lines on how I am comparing users.

 

[array]$MSADUsers = Get-ADUser -Filter * -SearchBase $MSOU -SearchScope Subtree | where {$_.enabled -eq $true} | select -Property UserPrincipalName 

[array]$MSAUUsers = Get-AzureADAdministrativeUnitMember -ObjectId $MSAU.ObjectId | Get-AzureADUser | select -Property UserPrincipalName

 

The following loop should return the two test users already in the AU. Once I have the correct data I'd switch the echo to the add AU command and flip to notin

 

foreach ($user in $MSADUsers)
{
if ($user -in $MSAUUsers)
{
echo $user
}}

 

Any ideas why I'm not getting any results?

Thanks,

[chaplic]

You're comparing a single MSADUser object to the MSAUUsers object, I doubt these are the same? One is an AD User and one an Azure AD user. I think you are wanting to compare the userprincipalname attribute on both?

Haven't tested but something like

 

foreach ($user in $MSADUsers.Userprincipalname)

{

 

if ($MSAUUUsers -contains $User) {#blah}

}

[ADMaster]

Thanks that did it. I now have AUs aligned with my OUs.

[chaplic]

Congratulations! for what it's worth, you've the first person I've ever seen using AUs!

[ADMaster]

I wanted to delegate password resets, that's the only reason I set it up.