GCDS + Password Sync to Azure AD

[MCPearson]

Hi folks,

 

Currently we're a Google Workspace school and provision our accounts from a local AD using GCDS and Password sync. Previously we were a Microsoft school and in the background we're still syncing groups and users up to Microsoft with Azure AD Connect, although our tenancy has been left to ruin.

 

I'm looking at changing how users are provisioned and authenticate, so it's all done through Azure AD. This is to get SSO more centralised for our systems, and well as have access to MS's superior conditional access policies. So, my question is: does anyone have any experience swapping this all around? Are there any tips you can offer, or know of any pitfalls to avoid? The last thing I want is for all of our docs to vanish into the ether trying to swap it all around

[jmak]

My experience is several years old and I was considering manually created Google accounts to provisioned by Azure AD Connect, but I did have issues. I would hope they've been sorted by now, but at the time I was speaking to both Google and MS support and didn't get a resolution.

 

I found that once I linked them, the single sign on worked, but existing users couldn't access their files. I overcame that by excluding that subset of users from migration.