Seperate acounts

[akidosaint]

Bit of Context with have Azure AD synch set up for on prem users Staff and pupils and we create non on prem users such as governors in the cloud. (Set up before my time would prefer governors to have on premises account with limited acccess)

 

One of our governors ASmith cloud account got synched into a new on prem account for new TA ASmith.

 

I'm trying to retain cloud account as ASmith but create new account for on prem to be ASmith1

 

I've created a test account and confirmed that this was caused by a synch no undue influence.

 

I've tried to update on premise account to correct email but this just updates the account as expected.

 

Also tried to delete the test account (TUser) from Azure update on premise test account (T1User) but this appears to loose the Tuser account into the Ether

 

Has anyone successfully separated accounts

Edited October 16, 2024 by akidosaint
corrected title

[DavR]

I don't think I've had your exact problem, but, the key thing when it comes to matching Azure AD with local AD accounts is the object, or matching, GUID. This is a unique string that matches the online with the local accounts. Break that, and you should break the link between the two accounts.

 

Most modern implementations will be using the AD attribute ms-Ds-Consistency-Guid to link the two, some older implementations used ObjectGuid. The quick and dirty way to break the link is to remove this attribute in local AD, although I'm not sure whether that removes it from the AAD side.

 

Another way is to move the local AD account to a folder that isn't sync'd with AAD, run a full sync, make any changes you need, then move it back to the sync'd folder. I think that resets the GUIDs.

[akidosaint]

I'll give this ago as i've run a delta sync but not a full sync i'll let you know the results

[akidosaint]

Cheers DavR

 

Worked like a charm on my testing accounts.

 

It was the initial sync option that i was missing i was able to recreate the account.

 

Process i followed

Move prem account in non Synched OU.

Run the following powershell from Azure synch server Start-ADSyncSyncCycle -PolicyType Initial

Modify on Prem account to updated details EG ASmith now ASmith1

Move account back to synched OU

Perform a delta synch Start-ADSyncSyncCycle -PolicyType delta.

Restore Azure account from deleted users apply licenses and ensure in correct groups etc.

[DavR]

Yup, that should do it!

 

Not sure if it needs to be Initial sync or if Delta would do it, but either way, job done.

[akidosaint]

A brief update. Even though above process worked for test accounts (unused) This failed to work for the live accounts unsure why but the final process i followed was

 

(Assumption that appropriate back up were taken)

Delete on prem account then carry out resynch.

Restored deleted account from deleted user. Restores account as cloud only.

Created on prem account with name variation. (moved appropriate files and folders to new locations)

Carried out Synch now 2 accounts in use on synched and one cloud only

[DavR]

You might find this thread really helpful on the point of restoring the account - https://techcommunity.microsoft.com/t5/security-compliance-and-identity/convert-on-prem-ad-users-from-office-365-azure-ad-to-in-cloud/m-p/42908

 

If you restore via PowerShell, you'll have the option to scrub out the ImmutableID (ie, the GUID is uses to match with on-prem AD) using Get-MsolUser -ReturnDeletedUsers | Set-MsolUser -ImmutableId "" so there's less chance of it matching when you re-introduce the local AD account.

 

You may also want to check whether your AD sync is set to soft match, or hard match, in Azure - https://www.linkedin.com/pulse/syncing-on-premises-active-directory-azure-ad-guide-ashkon-yasseri-tpgmc. If soft match is on, that could be matching and linking the accounts, despite you not wanting them too, due to name etc being the same. Hard match, on the other hand, should only link accounts where the sync GUID matches.