Syncing an existing AD account with 365

[Alastairb25]

Hi,

 

I have the following scenario :-

 

Local AD

Non synced OU - [email protected]

Azure Synced OU - [email protected]

 

Older users hare in Non synced

They have a 365 account but obviously not synced

 

We need them to sync in order to move to 365 properly and allow other services

 

We did the following

Renamed username to be f.lastname@

Moved to Azure OU

 

However they had [email protected] due to a quirk at the time.

 

Instead of creating a new O365 account it has synced with existing.

Which is what I wanted, however it will now only accept [email protected] but then fails afterwards

 

I am unsure why this is as how did it match as the email address was different?

If it has matched which seems to be the case why does f.lastname@ not work?

 

According to Microsoft it will work but it might take up to 24 hours

It shows ok in 365 and previous logons etc in Admin centre

Just fails to logon

 

 

TIA fellow Edugeeks

 

Alastair

Edited December 1, 2023 by Alastairb25

[Chuckster]

Renaming the username will simply not work.

 

In this case you will need to convert the ObjectGUID of the AD user into an ImmutableID that then can be applied to their M365 user account.

 

Have a read of this: https://www.orbid365.be/manually-match-on-premise-ad-user-to-existing-office365-user/

[dezt]

I've just had to do this exact thing on 4 AD's to one O365 tenant. Here is the PowerShell script I use to export the UPN and ImmutableID for users in an OU, then from the csv file I update the ImmutableID on the existing user in O365. After that is done I enable the AD Sync and the users matched and updated rather than create new users. I had to make sure that the UPN was the same on the AD users as the AAD users for this to work.

 

###### Generate Immutableid #########

$reportoutput=@()
$users = Get-ADUser -Filter * -Properties * -SearchBase "OU=,DC=,DC="
$users | Foreach-Object {

   $user = $_
   $immutableid = [system.Convert]::ToBase64String($user.ObjectGUID.tobytearray())

   $report = New-Object -TypeName PSObject
   $report | Add-Member -MemberType NoteProperty -Name 'DisplayName' -Value $user.DisplayName
   $report | Add-Member -MemberType NoteProperty -Name 'UserPrincipalName' -Value $user.UserPrincipalName
   $report | Add-Member -MemberType NoteProperty -Name 'ImmutableID' -Value $immutableid
   Write-Host ('INFO: The following user {0} has the Immutable of {1}' -f $user.name,$immutableid)
   $reportoutput += $report
}
# Report
$reportoutput | Export-Csv -Path $env:USERPROFILE\desktop\immutableid.csv -NoTypeInformation -Encoding UTF8

###### Update msol users ########

$csv1 = Import-Csv -Path $env:USERPROFILE\Desktop\immutableid.csv
Connect-MsolService 
#endregion 

Start-Transcript $env:USERPROFILE\desktop\PilotUser.csv

foreach($user in $csv1){

   #Set-MsolUserPrincipalName -UserPrincipalName $user.UserPrincipalName -NewUserPrincipalName $user.NewUserPrincipalName
   Set-MsolUser -UserPrincipalName $user.UserPrincipalName -ImmutableID $user.ImmutableID
   #Set-MsolUserPrincipalName -UserPrincipalName $user.NewUserPrincipalName -NewUserPrincipalName $user.UserPrincipalName
   Write-Host $user.DisplayName,"with userPrincipalName"$user.UserPrincipalName," has been set with ImmutableID",$user.ImmutableID

}
Stop-Transcript

[chaplic]

If your AD account has synced with the previous Cloud only object, (e.g changes someone’s name and 45 mins you’ll see it in AzureAD) then don’t think we need to worry about the immutableID to ms-ds-consisntencyguid talked about by others. There are bunch of things it’ll try to soft-match-on.

 

When you says username, what field do you mean? UserPrincipalName in AD will be the AAD login name, this need not be the same as the email address address. What does ‘failing afterwards’ mean? Do you authenticate via Microsoft or defer to ADFS?

[mukz]

proxyAddresses are correct?

[Alastairb25]

So under AD User \ General tab \ E-amil: - this field is just display?

The actual field to match is Attribute Editor tab \ proxyAddresses?

 

In our case No ProxyAddresses are set

We also have no immutable ID's within 365

 

That said some Mailboxes have the telephone number in which we think can only have been pulled from a previous install of AAD connect we were nto aware of..

 

Thanks