How to prevent spam messages? There are guidelines that you have to configure, so the…
Azure AD Connect is an excellent tool that syncs AD on-premises objects to Azure AD. What if the user object is created in the cloud directly and there is no AD on-premises object? Azure AD Connect will not create the user in AD on-premises. Deleting the cloud user and recreating it on-premises is a way, but what if the user uses the account with Exchange Online, Teams, SharePoint, and more services? In this article, we will look at how to sync Azure AD user to on-premises AD without deleting the Azure AD user.
Table of contents
- Correct way to create AD objects on-premises
- Check AD object sync status
- How to sync Azure AD user to on-premises AD
Correct way to create AD objects on-premises
It’s essential to create the AD objects on-premises when you have a Hybrid environment. That’s because the Azure AD Connect software will sync the on-premises AD objects to Azure AD. Not doing this will cause problems for the account. Not only that, it will not give precise reports when you want to check AD objects.
See below articles on how to create AD cloud objects from on-premises:
- Create Office 365 mailbox in Exchange Hybrid
- Create Office 365 shared mailbox in Exchange Hybrid
- Create Office 365 resource mailbox in Exchange Hybrid
- Bulk create Office 365 mailboxes in Exchange Hybrid
Check AD object sync status
Suppose the AD on-premises object is not present, and the user is created in the cloud. The user already uses the account and has data in the Exchange Online mailbox. Not only there but also in Sharepoint, Teams, and more.
To check the user sync status, follow these steps:
- Sign in to Microsoft 365 admin center
- Expand Users and click on Active users
- Enable the Sync status column
- Search the user
- Find sync status
The sync status will show one of the following:
- In cloud
- Synced from on-premises
The below screen shows that the user Carol Baker is in the cloud and not synced from AD on-premises. However, the other two users are synced from on-premises.
So how do we change the object in the cloud to synced from on-premises? Let’s look at how to sync the Azure AD user to on-premises AD in the next step.
How to sync Azure AD user to on-premises AD
To sync an Azure AD user to on-premises AD, follow these steps:
Step 1. Create on-premises AD user object
It’s essential to create an AD object identical to the cloud object:
- User logon name (UserPrincipalName)
Create an on-premises AD user object and fill in the details. Ensure that you fill in the user logon name identically to the cloud object.
Note: The password will reset to the one you create in AD on-premises. So it’s good to inform the user before you apply the change. Then, the user can reset the password later.
Fill in the E-mail identical to the cloud object.
Fill in the proxyaddresses.
If the user has aliases, add them. Remember that SMTP (capital letters) is the primary email address and that smtp (small letters) are aliases.
Step 2. Force Azure AD sync
PS C:\> Start-ADSyncSyncCycle -PolicyType Delta Result ------ Success
Step 3. Check Azure AD Connect synchronization service
Start the Azure AD Connect Synchronization Service Manager on the Azure AD Connect server. Verify that it adds the on-premises AD user object to Azure AD and that there are no errors.
Click on the Distinguished Name.
Verify that it adds the AD object.
Step 4. Verify AD object sync status
It’s good to give the Azure AD Connect synchronization service a little time (5-10 minutes) before you jump into Microsoft 365 admin center and check the sync status.
The Microsoft 365 admin center shows the sync status as synced from on-premises.
Step 5. Verify objectGUID and ImmutableID attribute
Another way is to compare the on-premises AD attribute objectGUID with Azure AD attribute ImmutableId. They need to match identically.
Note: The on-premises AD object values are GUIDs, whereas Azure AD is a base64 encoded text string. So you have to convert the base64 to GUID or the other way around to compare the values.
Run PowerShell as administrator and run the Get-ADUser cmdlet to get the ad user objectGUID.
The objectGUID is c7bb8a7c-26ca-43ec-ad28-d1f09acf433c.
PS C:\> Get-ADUser "Carol.Baker" | fl UserPrincipalName,objectGUID UserPrincipalName : Carol.Baker@exoip.com objectGUID : c7bb8a7c-26ca-43ec-ad28-d1f09acf433c
Run PowerShell as administrator and connect to Azure AD.
PS C:\> Connect-MsolService
Run the Get-MsolUser cmdlet to get the ad user ImmutableId.
The ImmutableID is fIq7x8om7EOtKNHwms9DPA==.
PS C:\> Get-MsolUser -UserPrincipalName "Carol.Baker@exoip.com" | fl UserPrincipalName,ImmutableId UserPrincipalName : Carol.Baker@exoip.com ImmutableId : fIq7x8om7EOtKNHwms9DPA==
Copy the ImmutableID and paste it into the below command to convert the base64 string to GUID.
PS C:\> [GUID][system.convert]::FromBase64String("fIq7x8om7EOtKNHwms9DPA==") Guid ---- c7bb8a7c-26ca-43ec-ad28-d1f09acf433c
Suppose you want to convert the GUID to base64 string, copy the GUID and paste it into the below command.
PS C:\> [Convert]::ToBase64String([guid]::New("c7bb8a7c-26ca-43ec-ad28-d1f09acf433c").ToByteArray()) fIq7x8om7EOtKNHwms9DPA==
The on-premises AD object and Azure AD object are the same.
Step 6. Make cloud mailbox visible in Exchange on-premises
Ensure that you make the cloud mailbox visible in Exchange on-premises by following the article Office 365 mailbox not showing in Exchange Hybrid on-premises.
Read more: Find Azure AD Connect accounts »
You learned how to sync missing on-premises AD objects from Azure AD. Create the on-premises AD object and sync it with Azure AD Connect. Ensure that there are no errors and verify the attributes GUID and ImmutableId match. By doing this, there is no need to delete and recreate the AD object on-premises and sync it to Azure AD. That will take time, and you must export and import all the settings.
Did you enjoy this article? You may also like Upgrade Azure AD Connect. Don’t forget to follow us and share this article.