Category: Azure

When AD -> Azure Sync Fails for a User
article #1417, updated 4 days ago

There are many ways of doing this. Here is one way to bring everything into a single consistent behavior, a landing place from which you can vary slightly at need.

This presumes that you have Azure/AD sync installed and working in general, and yielding errors in the Synchronization Service window for one or more users. Make sure that you don’t have duplicate email addresses in AD, that could be bad.

The first steps are in Active Directory Users and Computers.

  1. Set the user’s email correctly in his/her AD object, in “E-mail” under General.
  2. Set proxyAddresses in the Attribute Editor. The primary email address has to be the same, and in proxyAddresses has to be of the format “SMTP:email@domain.com”. There can be others in proxyAddresses but smtp must be lowercase. Also in proxyAddresses, set mailNickname blank.
  3. Under Account, either the user login name plus the dropdown domain is to be the same as the above, or it is to be a valid login according to the O365 console. If the dropdown domain list is local only, you can add the Internet domain list in Active Directory Domains and Trusts, with a right-click on the root level in the left pane of that window, and then an add of one or more alternative UPN suffixes. Then restart ADUC and the domain(s) you just added will be available in the dropdown.

Now we do some other things.

  1. Run Azure/AD sync, this is CMD, do it as administrator:
repadmin /syncall /AdeP
@"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command ^
"Import-Module ADSync; Start-ADSyncSyncCycle -PolicyType Delta"
  1. If you see errors in the Synchronization Service window, run something called a “hard match”, which changes enough to connect the AD user of that email address, with the Azure user of that email address. Here’s a script for it, Powershell; you’ll need to log into the O365 tenant. Note that while $AzureUPN is the O365 “primary email address”, $ADUPN is the double item under Profile in AD, the username plus the domain dropdown.
$AzureUPN = "user_email_on_azure@domain.com"
$ADUPN = "user_login_in_ad@domain.com"

"First connect to AzureAD:"
Connect-AzureAD

"Now get Azure ImmutableID:"
$AzureUser = Get-AzureADUser -SearchString $AzureUPN
$AzureUser.ImmutableID
""
""
"Extracting AD GUID..."
ldifde -f export.txt -r "(Userprincipalname=$ADUPN)" -l *
$ADGUID = (-split (type export.txt | select-string "ObjectGUID"))[1]
"Extracted AD GUID:"
$ADGUID
""
""
Set-AzureADuser -ObjectID $AzureUser.ObjectID -ImmutableID $ADGUID

"New Azure ImmutableID re-extracted for confirmation:"
$AzureUser = Get-AzureADUser -SearchString $AzureUPN
$AzureUser.ImmutableID

Categories:      

==============

Troubleshooting Azure AD Sync: Synchronization Service Manager
article #1371, updated 359 days ago

Search the machine for the “Synchronization Service Manager”. That’s the GUI debugger.

Categories:      

==============

Sync AD to DCs and Azure
article #1346, updated 403 days ago

In one swell foop, sync your AD to other domain controllers and Azure. Paste this into administrative Powershell, on the domain controller which does your Azure sync:

repadmin /syncall /AdeP
Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Initial

And here is the same command set, suitable for a batch file to be run as administrator:

repadmin /syncall /AdeP
@"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command ^
"Import-Module ADSync; Start-ADSyncSyncCycle -PolicyType Initial"

Categories:      

==============

Turn Off Azure AD Sync via Powershell
article #1334, updated 550 days ago

  1. Install the Azure Active Directory Module for Powershell.
  1. Connect to Azure AD, and disable sync:
Set-MsolDirSyncEnabled –EnableDirSync $false
  1. Check status, repeatedly, until it returns False. It can take 72 hours for sync to be fully deactivated.
(Get-MSOLCompanyInformation).DirectorySynchronizationEnabled 

Categories:      

==============

New version of Azure AD Sync
article #1249, updated 887 days ago

New version, as of 2018-10-29:

www.microsoft.com/en-us/download/details.aspx?id=47594

Categories:      

==============

Measure latency to Azure sites, live
article #1238, updated 940 days ago

Rather interesting diagnostic.

http://azurespeedtest.azurewebsites.net/

Categories:      

==============

Office 365 / Exchange Online Mailbox Migration Stall
article #1232, updated 953 days ago

When you do an Office 365 / EOL migration with Azure AD Sync in place, mailboxes may freeze up, where in the O365 console under “Mail Settings” for one or more mailboxes, it says “This user’s on-premises mailbox has not been migrated to Exchange Online. The Exchange Online mailbox will be available once migration is completed.” One may spend a whole lot of time, even with Microsoft on the line, not fixing this problem.

There may be more than one cause. But a very important cause and fix is outlined here:

https://mikeparker365.wordpress.com/2016/01/07/how-to-filter-out-msexchmailboxguid-from-aad-connect-sync/

The gist of it is, one of the user attributes synched up from the on-prem server is “msExchMailboxGuid”, and this is trouble, because if this is synched up, EOL thinks it is trying to make a duplicate of an existing mailbox, rather than a new one, and it will not make a duplicate, it is in fact waiting for this attribute to be deleted before proceeding.

So what we do, is we go to Synchronization Service, right-click on “Active Directory Domain Services”, make sure “Connector Designer” is selected, and then scroll down to msExchMailboxGuid , and uncheck it. Then click OK.

The next step is to kick off a sync. The easiest way is in Powershell on the server which has AD Sync installed:

Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Initial

You can watch the progress in “Synchronization Service” if you like; after the two final exports are complete it is done. But we’re not done yet.

The next step, is to remove the licenses from all of the O365 accounts which are marked as not yet migrated.

Then run another sync.

Then add the licenses back.

And run another sync.

That did it this morning!

Categories:      

==============

Run Azure AD Sync by Powershell
article #1231, updated 953 days ago

These two will do it in the current version as of this writing:

Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Initial 

The above is a full sync, necessary in a minority of circumstances. A delta sync is as follows:

Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Delta

Categories:      

==============

Azure Active Directory Sync Stops Working
article #1080, updated 1318 days ago

If this stops working, often it’s due to Microsoft updates of various sorts, cloud or LAN server or both. The first thing to try usually fixes it, unless your AD sync tool is very out of date; if it is very out of date, update first!

  1. Run Azure AD Connect
  2. Choose Customize Synchronization Options, click Next
  3. Sign in with Azure administrative creds
  4. Run through the wizard, choose your settings carefully carefully.

Done!

Categories:      

==============

ADSync errors, event IDs 6127, 6126
article #974, updated 1730 days ago

Here’s a great set of steps for these:

http://blog.jocha.se/tech/azure-ad-sync-event-error-6126-and-6127

The short of it is:

  1. Bring up the Syncronization Service Manager (“Synchronization Service” in Windows search),
  2. Click on Connectors,
  3. Click on “Active Directory Domain Services”,
  4. Click Run in the right pane, choose Full Synchronization, click OK, and wait for completion to be reported (it’s fairly obvious),
  5. Click Run in the right pane, choose Full Import, click OK, and wait for completion to be reported,
  6. Click Windows Azure Active Directory,
  7. and do the same two Runs as for the other line item.

Categories: