AD -> O365 Sync

[Jawloms]

Morning,

 

I created all my new year 7 accounts over the summer, which then sync'd up to O365 and created all of those accounts for me. For "reasons", all the year 7 accounts were removed from AD. They are now re-created in AD but of course the sync process sees them as different enough accounts that it wants to create new ones, but is complaining about duplicates already being in O365 as of course the names already exist. Can I tie the two together somehow, or am I better just deleting them from O365 and letting them be re-created by the sync process?

 

I suspect the latter......

 

Stuart

[CHiLL]

If you have Microsoft licensing, such as EES or OVS-ES, I wonder if it would be easier to raise this with Microsoft directly, through their M365 support portal in your admin centre? That sort of support issue should be covered by your licensing model and at least it would be dealt with by Microsoft themselves, than you trying to quickly bodge a solution that may not be the best long term.

[snagrat]

I think the only way to do this would be to disable the sync, clear the ImmutableID and enable it again. This will apply to all users though.

 

When the sync is enabled it will soft match all accounts again.

 

But disabling and enabling isn’t instant and can take 72 hours to allow you to do it

[Chuckster]

ImmutableID will need to be cleared on all the Y7 accounts, and then re-sync.

[chaplic]

This is very doable

 

Look at your new accounts in AD, there is a field, ms-ds-consistencyguid field.

 

Look in Azure AD/ get-msoluser every account has an immutableID field

 

These just need to be the same for the accounts to link up.

 

you need to change the AD fields to match the immutableID field in AzureAD. Unhelpfullly it's not just a copy and paste as there are encoded differently

 

 

[Powershell Script] Convert ImmutableID – Jumlins TechBlog

 

 

The ImmutableID Match in AADC environments - Scripting up in the Cloud (up-in-the.cloud)

[jthompson]

This can be fixed. You'll need to update the ImmutableID of each of the affected O365 accounts with the ImmutableID of their new respective local AD accounts. This will match the Azure accounts back up with their new local counterparts, and your syncs will then be happy again.

 

From your local server with AD management tools installed, run the following. You'll need to have a working web connection available, so that PowerShell can talk to Azure.

 

Import-Module ActiveDirectory
Import-Module AzureAD
Connect-AzureAD

 

The save the following as a ps1 script and run it. Adjust the value of $OUpath to be what you need (assuming that all your affected accounts are in a particular OU.)

 

$OUpath = 'OU=Intake2023,OU=Students,DC=your,DC=internal,DC=schooladdomain,DC=tld'
$users = Get-ADUser -Filter * -SearchBase $OUpath
foreach ($user in $users)
{
 $immutableid = [system.convert]::ToBase64String($user.ObjectGUID.tobytearray())
 Set-AzureADUser -ObjectId $user.UserPrincipalName -ImmutableId $immutableid
}

[Jawloms]

Wow, thank you all very much for your help. I'll take a look through these.......