0

I recently put Azure AD Sync in place for a client that was previously syncing IDs to Office 365 using the Windows Server Essentials Experience plugin on a DC running Server 2012 R2. This was very easy to set up and simple to reconcile the existing on prem AD users to the accounts they had been using already on Office 365.

From what I understand the Essentials plugin uses a variation on DirSync to synchronize your local users to Office 365. I read that DirSync would eventually no longer be supported soon. With this in mind I prepared to upgrade the sync to use the newer Azure AD Sync tool. The install and initial config for the on prem DC was easy but after my initial sync I noticed that only my on prem account had reconciled with its Azure AD counterpart. All other on prem accounts ended up getting cloned, resulting in two accounts for each user: their original Azure AD account and another new account using the default @onmicrosoft.com username. Of course, their on prem AD account maps to the @onmicrosoft account and not their original Azure AD account as I would have hoped.

Now I am left with a bit of a mess on my hands and unsure how to proceed. I would like to reconcile the other accounts to the Azure AD accounts they currently use but i have not seen a way to cleanly do it. The only method I can think of is to back up each user's data from 365, delete that account then transfer the license to the @onmicrosoft account and set up their stuff again. It would be a painful process for each user and one I would rather avoid.

Has anyone else run into this? If I were starting with a clean Azure AD, this would have been a very simple process but none of the scenarios I have read about gave me an idea how to set this up between an on prem AD with an already populated Azure AD let alone reconcile after the fact.

1

I would say start here and look at the Installation of Azure AD Connect on separate server section. You should be able to export your current DirSync information from the Essentials setup. I believe this is the process you would have wanted to follow initially.

As for cleanup, I suggest you try to delete the duplicated records ASAP. If your business users have already started to use the "new" IDs then you are going to have trouble (it sounds like this is the case).

  • The weird thing is that the UPNs stayed associated with the old Azure AD accounts they were using so, to the users, it just seems like PWs are out of sync. Azure AD Sync created its own accounts in Azure. They really do not interfere with the users old accounts in any way. I wish i could simply delete the duplicate records but since they were are synced from the on prem AD, I cannot do it from Azure, lest the account would just get re-synced again. What I was really hoping to find is a way from the on prem AD to re-map the UID from one account to another. – Tyson Navarre Sep 15 '15 at 21:04
  • ...So I take it you aren't using Exchange Online, otherwise you would have very unhappy users. – blaughw Sep 15 '15 at 22:23
  • What is the status of one of the "old" accounts if you do Get-MsolUser? Is it disabled/soft-deleted? – blaughw Sep 15 '15 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.