I have had the following scenario working fine for years.
- One simple local AD domain (local.whatever.com) with user LOCAL\john.doe (Domain Admin)
- One isolated Office 365 tenant (whatever.com) with user email@example.com (Office 365 Global Admin)
Even though the local AD user conceptually corresponded to the Office 365 user, there was no specific link between them, so the local domain and Office 365 tenant were isolated repositories.
Now, I decided to deploy and configure Azure AD Connect to get my local domain and Azure AD synchronized, so I did the following:
- Added whatever.com UPN to the local active directory (local.whatever.com)
- Set the email address on LOCAL\john.doe to firstname.lastname@example.org
- Installed and configured Azure AD Connect
- Ran the first full synchronization
The result was:
- A new account was created in Azure AD in the form email@example.com (note the random number at the end of the username)
- The Office 365 account and the local AD account did not get linked.
This makes sense because I never had the chance to instruct Azure AD Connect to map the local AD user with the Office 365 user.
So, I found this article: Azure AD Connect: When you have an existent tenant
After reading the previous article, it seems to me that I should set up a mapping between both users to make it work. However:
- I don't understand what would be the steps to make this mapping happen
- Deleting the existing user in Azure AD would not be an option due to the fact that the non-synched user is the only Global Administrator in the Office 365 tenant.
In addition, I came across the following warning in the Microsoft documentation:
Microsoft strongly recommends against synchronizing on-premises accounts with pre-existing administrative accounts in Azure Active Directory.
Any known fix or workaround?