Fix Azure AD Sync: Unterschied zwischen den Versionen
K |
|||
| (2 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) | |||
| Zeile 14: | Zeile 14: | ||
Generate new ImmutableId from domain account for sourceAnchor (here: objectGuid): | Generate new ImmutableId from domain account for sourceAnchor (here: objectGuid): | ||
| − | <syntaxhighlight lang=powershell>[system.convert]::ToBase64String((Get-ADUser user). | + | <syntaxhighlight lang=powershell>[system.convert]::ToBase64String((Get-ADUser user).objectGuid.ToByteArray())</syntaxhighlight> |
| Zeile 27: | Zeile 27: | ||
'''As a side note:''' | '''As a side note:''' | ||
| − | PowerShell throws a cryptic error message when trying to reenable if sync has not been fully disabled (which could take up to 72h as said before). | + | PowerShell throws a cryptic error message when trying to reenable if sync has not been fully disabled (which could take up to 72h as said before).<br /> |
| − | + | The AD Connect configuration tool shows a more meaningful message about the 'pending disable state'. Also it halts synchronisation when open, reenables sync by itself and features a nice retry button. So after setting the ImmutableId for each user, simply walk through configuration until the error message and retry button appear. | |
| − | The AD Connect configuration tool shows a more meaningful message about the 'pending disable state'. Also it halts | ||
Aktuelle Version vom 1. November 2016, 17:18 Uhr
After changing the source of sourceAnchor that gets used for mapping on-premise users to Azure AD users (i.e. after a cutover migration or other nice things), the ImmutableId in Azure AD needs to be changed. Here's how to get this done.
Connect via Connect-MsolService
Disable Directory Sync (could take up to 72h for completion, status possibly shows false prior to that):
<syntaxhighlight lang=powershell>Set-MsolDirSyncEnabled –EnableDirSync $false</syntaxhighlight>
Check status (should be false):
<syntaxhighlight lang=powershell>(Get-MSOLCompanyInformation).DirectorySynchronizationEnabled</syntaxhighlight>
Generate new ImmutableId from domain account for sourceAnchor (here: objectGuid):
<syntaxhighlight lang=powershell>[system.convert]::ToBase64String((Get-ADUser user).objectGuid.ToByteArray())</syntaxhighlight>
Set new ImmutableId for MsolUser:
<syntaxhighlight lang=powershell>Set-MsolUser -UserPrincipalName user@contoso.com -ImmutableId "01234567890123456789=="</syntaxhighlight>
Enable Directory Sync (only possible after disabling has completed, could take 24h after enabling to complete):
<syntaxhighlight lang=powershell>Set-MsolDirSyncEnabled –EnableDirSync $true</syntaxhighlight>
As a side note:
PowerShell throws a cryptic error message when trying to reenable if sync has not been fully disabled (which could take up to 72h as said before).
The AD Connect configuration tool shows a more meaningful message about the 'pending disable state'. Also it halts synchronisation when open, reenables sync by itself and features a nice retry button. So after setting the ImmutableId for each user, simply walk through configuration until the error message and retry button appear.
