#dirsync

[psconfig]

Describes how to upgrade from DirSync and Azure AD Sync to Azure AD Connect.

Azure AD Connect is the best way to connect your on-premises directory with Azure AD and Office 365. This is a great time to upgrade to Azure AD Connect from Windows Azure Active Directory Sync (DirSync) or Azure AD Sync as these tools are now deprecated and will reach end of support on April 13, 2017.

You still have three days to upgrade and maintain support. Upgrading from either DirSync or Azure AD Sync is easy as can be.

[psconfig]

New behavior of how to handle objects with UPN or ProxyAddress conflicts during directory sync using Azure AD Connect.

Duplicate Attribute Resiliency is a feature in Azure Active Directory that will eliminate friction caused by UserPrincipalName and ProxyAddress conflicts when running one of Microsoft’s synchronization tools.

Identity collision a real thing. With this update, directory synchronization becomes even less of a black box.

[benwaynet]

Active Directory Federation Services (AD FS) & Azure Active Directory Sync (DirSync) Resources

Active Directory Federation Services (AD FS) & Azure Active Directory Sync (DirSync) Resources

Consolidated list of the best resources for AD FS, Dirsync and Windows Azure AD, including blogs, documentation, videos, tutorials and best practices.

Source: Active Directory Federation Services (AD FS) & Azure Active Directory Sync (DirSync) Resources – Simon May

This link is a great resource for ADFS and AD-Connect questions.

If your still running DirSync or Azure AD Sync here is the…

View On WordPress

[adventures-in-systemsland]

Get Dirsync status with PowerShell

One of the biggest challenges I faced while automating mailbox creation and migration within a hybrid Exchange/O365 environment was figuring out when Dirsync had finished running.

By default, Dirsync runs x hours after the time the last cycle completes, which means that Dirsync never really runs on a fixed schedule. But, how does Dirsync know when the cycle completed?

Turns out, there’s a value in Get-MsolCompanyInformation called LastDirsyncTime. Get that value, store it in a variable, run Dirsync, then use a while loop to compare the value in your variable with the current value of LastDirSyncTime until the current value exceeds your variable value.

Here’s the code snippet, and the full function I use for O365 to On-Prem migration is below the cut.

$DirSyncTimeBefore = Get-MsolCompanyInformation | select LastDirSyncTime $dstimeb = $DirSyncTimeBefore.LastDirSyncTime Write-Output "Time before is $dstimeb"

$ScriptBlock = { Invoke-Command -ComputerName dirsyncserver.domain.com {C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ` -psconsolefile "C:\Program Files\Windows Azure Active Directory Sync\DirSyncConfigShell.psc1" ` -command "Start-OnlineCoexistenceSync"} } while ($timetest  -ne $True){    $DirsyncTimeNow = Get-MsolCompanyInformation | select LastDirSyncTime    $dstimen = $DirsyncTimeNow.LastDirSyncTime    $timetest = $DirsyncTimeNow.LastDirSyncTime –gt $DirSyncTimeBefore.LastDirSyncTime    Write-Output "Time now is $dstimen"    Start-Sleep(20)

   Function Invoke-MailboxMigration    {    <#     .SYNOPSIS     Migrates a mailbox from O365 to On-prem.     .DESCRIPTION     Cmdlet prepares mailbox for migration, starts dirsync, then finishes migration after dirsync has finished.     .EXAMPLE     Invoke-MailboxMigration -Username meowth -GUID "0x000x00-y0yy-000y-0000-00000z0z00zz"     #>    [CmdletBinding(SupportsShouldProcess=$True,ConfirmImpact='Low')]    param       (     [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True,Position=0,HelpMessage='Please enter a username')] [string]$Username,     [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True,Position=1,HelpMessage='Enter a GUID')]       [string]$GUID,   [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True,Position=2,HelpMessage='Enter a database')]       [string]$Database       )    #region setup    $EmailAddress = [string]::Concat($($Username),"@domain.mail.onmicrosoft.com")      Enable-Remotemailbox $Username -remoteroutingaddress $EmailAddress    Set-Remotemailbox $Username -ExchangeGUID $GUID    Write-Output "Began migration process for $Username with remote routing address $EmailAddress and GUID $GUID"    #endregion

   #region Dirsync    try{Get-MsolAccountSku -ErrorAction Stop }    catch [Microsoft.Online.Administration.Automation.MicrosoftOnlineException]    {"Not connected to MSOnline. Now connecting."    $O365pw = ConvertTo-SecureString -AsPlainText -Force -String s3cretP@ssw0rd!    $O365Cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "[email protected]",$O365pw    Connect-MsolService -Credential $O365Cred    }

   $DirSyncTimeBefore = Get-MsolCompanyInformation | select LastDirSyncTime    $dstimeb = $DirSyncTimeBefore.LastDirSyncTime    Write-Output "Time before is $dstimeb"

   $ScriptBlock = {    Invoke-Command -ComputerName dirsyncserver.domain.com {C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe `    -psconsolefile "C:\Program Files\Windows Azure Active Directory Sync\DirSyncConfigShell.psc1" `    -command "Start-OnlineCoexistenceSync"}    }

   while ($timetest  -ne $True){       $DirsyncTimeNow = Get-MsolCompanyInformation | select LastDirSyncTime       $dstimen = $DirsyncTimeNow.LastDirSyncTime       $timetest = $DirsyncTimeNow.LastDirSyncTime –gt $DirSyncTimeBefore.LastDirSyncTime       Write-Output "Time now is $dstimen"       Start-Sleep(20) #sleep for 20 seconds    }    #endregion

   #region mailboxMove    $ExPW = ConvertTo-SecureString -AsPlainText -Force -String s3cretP@ssw0rd!    $ExCred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "domain\exchangeAdmin",$ExPW    New-MoveRequest -Outbound -RemoteTargetDatabase $Database -RemoteHostName mailserver.domain.com -RemoteCredential $ExCred -TargetDeliveryDomain domain.com -Identity [email protected]    #endregion    }

[psconfig]

I'm happy to let you know that the second preview release of Azure AD Connect is now available. If you just want to get started, you can get it here. Those of you who follow the blog know that Azure AD Connect is a tool that simplifies synchronization of your on-premises directories with Azure AD to enable single sign-on to Office 365 and thousands of SaaS and on-premises applications. Since we released the first preview in December we seen a ton of interest and received lots of useful feedback. Today's release has several new capabilities and a bunch of quality improvements and bug fixes based on that feedback.

There are some really nice updates in the latest preview release of the Azure AD Connect tool. Drumroll please!

Support for upgrade from DirSync or AAD Sync

Support for existing SSO deployments

Sync filtering based on an AD group

Support for additional [Preview] sync options like device sync and user writeback.

A list of additional tasks that can be performed post-AD Connect configuration such as adding additional AD domains for federation

[activedirectoryfaq]

Office 365 and On-Premise with Federation and DirSync

Today I want to write about Office 365 and On-Premise with Federation and DirSync.As I think functionality and typical questions are the most interesting for you, I want to focus on that. The following picture shows the architecture of an Office 365 environment. It is connected to an On-Premise...

Read the full Article http://activedirectoryfaq.com/2015/01/office-365-premise-federation-dirsync/

#DirSync, #Federation, #Office365, #OnPremise

[psconfig]

Azure Active Directory Sync Goes GA

Azure Active Directory Sync (AADSync) has gone GA! This is great and opens up a number of new scenarios that were previously unavailable with DirSync. Before you all go and hop on the AADSync train though, be mindful of it's current limitations. The Directory Integration Tools Feature Comparison entry on TechNet describes this in detail. One of the major features still missing is Password Hash Sync, so if you deploy AADSync today, you'll have to stick with Federated SSO.