0

We are trying to synchronise our on-premises AD with Azure Active Directory for Microsoft 365. I just want to confirm:

  • If users on-premises have the same username as their Microsoft 365 username, will they be synchronised with the correct Microsoft 365 user?
  • Will they have access to their emails with their on-premises credentials?
  • Also, there were a lot of random guest users in our AD. They looked like contacts, will they be deleted?

2 Answers 2

2

To clarify... you're not moving your on premises users to Office 365, you're syncing them to Office 365.

Will they match? Probably, but you need to understand how hard matching and soft matching works.

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-existing-tenant

Will they have access to their emails with their on-premise password? If you use Password Hash Synchronization or Pass-through Authentication they will.

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta

1
  • Or ADFS, for auth.
    – LeeM
    Aug 18, 2020 at 11:27
0

Existing guests won't be deleted. They are often accounts that used their corporate email address to sign up for some Microsoft services. If they haven't been logged on for a while, I'd disable them and then delete them in a few months if no-one yells.

If you have "guests" that are actual current employees that should be members of the tenant, I would send out advice that these accounts will disappear. Maybe they signed up for Office 365 or something. If they downloaded Office 365 and associated a license to it from your tenant, they will have to fix that up. There's instructions on the web.

With all the above, I'm assuming there are very few users in that boat. If you have many, many users already in the tenant, you need to figure out how they got there first.

While the identities are separate objects in AD and AAD, they are "joined" via a unique ID. It seems likely you don't know anything about FIM either, but on the off chance, you'll see the user objects in the AAD Connect metaverse have two connectors - one for AD and one for AAD. This is what allows the magic to happen. Such as authentication to work in the cloud and on-prem with the same credentials (if you're not using ADFS), and the user account properties to synchronise.

I really, really hope you're starting off in a test environment so you can understand this stuff a little better.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .