Office 365 Sync AD Distribution Groups

[Guest Guest]

Hi,

 

How would I sync my local AD Distribution groups to O365 with members in the groups?

[snagrat]

Do you currently sync users?

[Guest Guest]

Yep,

 

Its just the distribution groups I'm struggling to sync to O365

[snagrat]

Is the OU they are in set to be synced?

[Norphy]

It should just be a matter of making sure that the OU that your groups live in is selected to be synced. I think you have to enable the syncing of group objects in AAD Connect as well Edited February 12, 2022 by Norphy

[Guest Guest]

I have selected the OU of where my groups are but still no luck in getting them synced. Any script that might do this?

[Roberto]

I have selected the OU of where my groups are but still no luck in getting them synced. Any script that might do this?

 

This isn't a "I just need to script harder" situation. Microsoft isn't hiding a "-syncGroupsNoReallyBillGates -ImeanitThisTime" switch in the powershell to run an AD connect delta sync that we're all under a strict NDA that mentions you by name to keep secret. This is a "this should already be happening based on what you've said, so something isn't right and needs fixing" situation.

 

So, are you sure the groups are in an OU you've configured to sync? Are you sure you've set groups to sync? Are your groups universal groups? (On-prem exchange lets you get away with mail-enabled global groups, O365/AAD is much more stringent in requiring groups to be set up correctly? Do they meet the other condtions in the link below(1) (e.g. correctly configured email address attribute of some kind? If all of these are correct and it's still not syncing, then are there errors in AD connect pertaining to the groups?

 

Have you set AD Connect to target members of a particular group to sync, and this is why its excluding other objects? (2)

 

What happens if you create a brand new, universal mail-enabled group in the OU where the current groups are? Does that work? What if you create a brand new, universal mail-enabled group in the OU your users are syncing from? Does that work?

 

(1) See https://docs.microsoft.com/en-us/azure/active-directory/hybrid/concept-azure-ad-connect-sync-user-and-contacts#groups

(2) https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering

Edited February 12, 2022 by Roberto

[snagrat]

Since selecting the OU have you run an Initial sync as Delta will not add OUs

[Roberto]

Since selecting the OU have you run an Initial sync as Delta will not add OUs

 

Good point, though iirc completing the AD Connect wizard that allows you to select new sync sources will kick off a full sync by default.

[snagrat]

Good point, though iirc completing the AD Connect wizard that allows you to select new sync sources will kick off a full sync by default.

 

If you used the wizard. I personally use the console to add OUs and then have to run the sync Script

[Guest Guest]

I used the ad connect wizard which syncs in full by default, It syncs users but no groups! weird!

[Jonah]

I used the ad connect wizard which syncs in full by default, It syncs users but no groups! weird!

 

Does the UPN suffix of the groups match your 365 tenant? If for example you have an internal UPN of “ad.domain.com” but this isn’t in 365 and e.g. your tenant is “domain.com”, you’ll need to change the UPN of the group to match.

 

Only mentioning it as it’s something we came across when we first started the sync to 365 a couple years ago.

[Guest Guest]

Oh that’s it!!! I didn’t think I needed to use the internal domain name in O365.

 

Thanks!!

[Guest Guest]

Forgot to install the provisioning agent and then groups started to sync! Yay \O/