Moving objects between AD domains both synced to the same Microsoft 365 tenancy

[pete]

If I have:

 

• AD domain01 syncing user, device and group objects to M365 tenancy domain01.onmicrosoft.com using Azure AD Connect (now Entra Connect).
  
• AD domain02 syncing user and group objects to M365 tenancy domain01.onmicrosoft.com using Entra Cloud Sync
  

and then I move a user object (standard domain/forest migration) from domain02 to domain01, ensuring:

 

• mS-DS-ConsistencyGuid is populated
  
• UPN and email address remain the same
  
• appropriate UPN suffixes are added to the receiving domain
  
• any automated licensing rules account for the new user objects
  

then the user object should (beyond a brief blip during migration) remain functional in the M365 tenancy once migrated across and have access to the correct data, right?

Edited January 25, 2024 by pete

[chaplic]

Done roughly this for a few hundred accounts.

 

Being pedantic ms-ds-consistencyguid being the same ​ is what’s important. You might need to consider MsExchMailboxGUID as well. I would also add user_ to the on the source AD to immediately stop the account being syncd from the old domain before you do stuff.

 

Interesting you have same UPN in both forests.

 

Also be aware the person will have to use their new passsword, assuming both old and new also use password hash sync

[pete]

Done roughly this for a few hundred accounts.

 

Being pedantic ms-ds-consistencyguid being the same ​ is what’s important. You might need to consider MsExchMailboxGUID as well. I would also add user_ to the on the source AD to immediately stop the account being syncd from the old domain before you do stuff.

 

Interesting you have same UPN in both forests.

 

Also be aware the person will have to use their new passsword, assuming both old and new also use password hash sync

 

Yeah, meant populated in old domain (need to manually enter it for the groups) and kept the same in the new domain.

 

Both use password hash sync, but wouldn't the password remain the same? Password data is synced during a migration between forests and (since our setup treats AD as the source of truth) the AD password from domain02 would be moved with the user object to domain01 and become the "official" source of password data for Azure AD.

 

So long as the user object is removed from sync in domain 02 to avoid having two services attempting to amend the same user object in Azure.

Edited January 25, 2024 by pete

[chaplic]

Yeah if you’re doing some magic so password is the same in both domains, should end up the same. Test test test, of course and the only thing I can think of is you might need to revoke tokens for the user, forcing them to login again (or just wait a while)

 

How are you squaring off Group and DLs?

[pete]

For domain02? Burning them down and recreating manually.

 

It's a tiny domain in terms of people, data and groups.