2

We're trying to link an existing on premises AD with an existing Office 365 (only mail).

We installed Azure AD Connect and went through the steps, we'd like our local AD passwords to be synced with Office 365 / Azure AD.

We set up filtering based on a group, in which we have one test user.

Questions:

  • does syncing only delete users on Azure AD if the user has been deleted from the local AD?

  • most importantly: our existing users on O365 which are not yet part of he filter (group) we use to configure the sync: they will NOT be deleted? (I'm assuming this but would like confirmation).

Thanks!

2
  • Azure AD Connect can synchronize all your (configured) accounts to azure AD with sync type Synced with Active Directory. It will not affect existing cloud account which sync type is In cloud. But if you want to link on-premise object with an existing Office 365 account, there are others to do. I'm not sure if this is what you need, so add comment here. Feb 27, 2017 at 9:41
  • Have you got any answer here? Mar 13, 2017 at 7:38

3 Answers 3

1

most importantly: our existing users on O365 which are not yet part of he filter (group) we use to configure the sync: they will NOT be deleted? (I'm assuming this but would like confirmation).

All existing user in O365 will stay, they wont be deleted.

1

We set up filtering based on a group, in which we have one test user.

Questions: does syncing only delete users on Azure AD if the user has been deleted from the local AD?

most importantly: our existing users on O365 which are not yet part of he filter (group) we use to configure the sync: they will NOT be deleted? (I'm assuming this but would like confirmation).

If a user is synced and then becomes outside of the scope of the group (or OU) that is filtered at that time the synced account will be deleted in Office 365 (with a grace period of typically 30 days). So if you delete that user in local AD it is synced and deleted in Azure AD. If you remove the user from the "UsersSyncedWithTheCloud" group then it is deleted from Azure AD. So don't think that you have to delete a synced user in your local AD in order to delete the user account in Azure AD.

The existing users in Azure AD will stay there unless/until you match them up with a local AD account. It's been a few years since I've done this, but in the dirsync days this was done via Primary SMTP matching (hint: the primary SMTP address is the local AD proxyAddresses attribute that has SMTP: in front of the email address -- anything else with the letters smtp at the beginning have to be lowercase smtp and AD does not validate having multiple entries starting with SMTP:). If the primary SMTP value in local AD matches the primary SMTP value in Azure AD the account is linked (if there isn't a duplicate) and an ImmutableID vaule then links the two accounts after that.

1

The answer to the questions:

1)Sync will not delete any existing accounts in Azure AD because there aren't any connections between your on-premise AD and Azure AD yet.

2)The same, your existing Office 365 accounts will not be affected.

4
  • As you commented above, "if you want to link on-premise object with an existing Office 365 account, there are others to do", could you please provide more instructions on this?
    – wandersick
    Sep 4, 2017 at 6:58
  • I found the answers here: github.com/MicrosoftDocs/azure-docs/blob/master/articles/…
    – wandersick
    Sep 4, 2017 at 7:21
  • Still, I find it critical to make sure no existing accounts in Azure AD gets deleted on next sync (those accounts that aren't in on-premises AD). How would we prevent deletion? May we make use of Enable-ADSyncExportDeletionThreshold -DeletionThreshold by setting it to 0, for example, to not allow any deletion at all?
    – wandersick
    Sep 4, 2017 at 8:08
  • This addresses some of the concerns but not all: "Azure AD Connect only deletes objects that it has once considered to be in scope. If there are objects in Azure AD that were created by another sync engine and these objects aren't in scope, adding filtering doesn't remove them. For example, if you start with a DirSync server that created a complete copy of your entire directory in Azure AD, and you install a new Azure AD Connect sync server in parallel with filtering enabled from the beginning, Azure AD Connect doesn't remove the extra objects that are created by DirSync" goo.gl/D837rf
    – wandersick
    Sep 4, 2017 at 9:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .