0

We use a cloud-hosted Office 365 domain for e-mail. Our users are synced from our Server 2008 R2 functional level domain.

Until a fortnight ago we were successfully using DirSync for this synchronisation process. Users and passwords were synced with the cloud and everything worked fine. If a user changed their AD password, the sync would run every 30 minutes and update their e-mail password.

As DirSync is being deprecated, we moved to Azure AD Connect. This has been set up in the same way - pointed at the same OU, password synchronisation enabled.

sync settings

The synchronisation process appears to run successfully every 30 minutes:

sync running successfully

When the system detects a password change, I can see this in the miisclient application:

password change update

The problem is... the passwords don't appear to be changing. Everyone who has changed password since we installed Azure AD Connect is still having to use their old password to log in to e-mail.

I have tried:

  • Forcing a full synchronisation using the command Start-ADSyncSyncCycle -PolicyType Initial. The sync runs, and objects are updated, but same issue with passwords still applies
  • Running a password synchronisation script (which at its core uses the syntax $p = New-Object Microsoft.IdentityManagement.PowerShell.ObjectModel.ConfigurationParameter "Microsoft.Synchronize.SynchronizationPolicy", String, SynchronizationGlobal, $null, $null, $null as well as a number of other command lines which I won't paste unless required). Not entirely sure what this did, if anything
  • Checking event viewer - but no errors at all

Does anyone have any ideas what I'm missing to enable the password synchronisation?

Improve this question
2
  • Is anything syncing? Your screenshot is missing "Export" which is what would actually propagate the change. Are you in staging mode perhaps?
    – CtrlDot
    Jun 8, 2016 at 20:26
  • Oh wow... I totally misread how Staging Mode works. Yep, that's the culprit!! Would you like to put an answer in @CtrlDot and I'll award you with the green tick?
    – turbonerd
    Jun 9, 2016 at 8:15

1 Answer 1

Reset to default
2

From the screenshot above, you are missing the "Export" task on both the local AD and the AAD.

This is generally the case when "staging" mode is turned on.

See this article for more information.

Try turning off staging mode.

Improve this answer
1
  • Thank you kind sir. And for not mocking my stupidity :D
    – turbonerd
    Jun 10, 2016 at 17:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .