AD Users Are "In-Cloud" Instead of "Syncing with AD" Now

[seeyoujs]

This morning when a password was reset for a user in Active Directory, the user’s Office 365 account ended up being deleted for some reason. When we restored his Office 365 mailbox, he was able to login, but his account now shows as In Cloud. I created a test user to further investigate and they are showing as “In Cloud” in Office 365 instead of “Synced with Active Directory”. Not only that, but I was unable to sign into the Outlook of this test user with the password I created in AD. My thought at this point is that Office 365 is not actually synced with Active Directory.

So, my questions at this point are: how do I tell which OUs are set to actually sync and how do I check if they are syncing if DirSync is showing no errors? What usually causes this and what should be done to avoid this situation in the future?

I went into the DC and Azure AD Connect looks to have never been setup from what I can see and I am unable to access the Synchronization Service Manager as it gives an error message when I connect with the service either not being on or my account not being a member of the required security group. My boss is under the impression that access to Office 365 should just tie to the security group, but it seems like there is an issue.

[DragonsRule]

@seeyoujs

So, my questions at this point are: how do I tell which OUs are set to actually sync and how do I check if they are syncing if DirSync

Are you using Dirsync? That may be the issue. That was deprecated years ago. You should be using AADConnect.

[seeyoujs]

I think I misspoke. I do show AAD Connect Status where it shows the latest directory sync status, so I am assuming that is what we actually had. Before, when I did see an error (unrelated), I believe it said DirSync error, so that may be where some of my confusion is coming from.

[DragonsRule]

@seeyoujs

I went into the DC and Azure AD Connect looks to have never been setup from what I can see and I am unable to access the Synchronization Service Manager as it gives an error message when I connect with the service either not being on or my account not being a member of the required security group. My boss is under the impression that access to Office 365 should just tie to the security group, but it seems like there is an issue.

Oh. I would open a ticket with O365 support. They will remote in and help you get it properly configured.

[da-schmoo]

The Home Page of the O365 Portal will show if you are using AADConnect. The box at the upper left with show the AADConnect status and if there is a problem. If the upper left box just says “Active Users” that means you are not using AADConnect.

Some place to start.

[seeyoujs]

I checked the O365 Portal page and do show an AADConnect status.

[DragonsRule]

And what’s that status say? How long since last sync?

[seeyoujs]

It says 25 minutes ago and hasn’t had any errors or anything in the AAD Connect Status section at all today.

[DragonsRule]

Ok, in that case you’ll want to delve into the settings. You are probably correct that it’s not configured for the OUs you think it is.

Connectors, click your domain, Properties, Configure Directory, Containers.

[da-schmoo]

Are you running this tool to see the status?

“C:\Program Files\Microsoft Azure AD Sync\UIShell\miisclient.exe”

[DragonsRule]

@da-schmoo

Are you running this tool to see the status?

“C:\Program Files\Microsoft Azure AD Sync\UIShell\miisclient.exe”

This is what I meant, btw, in my post above. Once you’ve opened that, you would navigate as I listed.

[seeyoujs]

Thank you! I am unable to access the Synchronization Service Manager as it gives an error message when I connect with the service either not being on or my account not being a member of the required security group.

[da-schmoo]

You want to make sure you’re accessing it from the correct server - doesn’t have to be on a DC.

[DragonsRule]

@seeyoujs

Thank you! I am unable to access the Synchronization Service Manager as it gives an error message when I connect with the service either not being on or my account not being a member of the required security group.

Your user ID does need to be in the proper security group or it won’t work, that’s for sure.

[seeyoujs]

Figured out which account through AAD Connect on the server. I am now logged in as that and am able to access it. Am going to be going through the steps shortly.

[seeyoujs]

Looks like the correct containers are checked. Hmmmm…trying to figure out how the users in that OU are getting set to In-Cloud then.

[DragonsRule]

AADConnect is one way - items in AD get moved to O365. If you create something new in O365 it will be cloud only.

[seeyoujs]

Absolutely! In this case, I created it in AD though and showed that.

I am checking the Server Manager and am showing the following error over and over:

"The management agent “domain.name” completed run profile “Delta Import” with a delta import or delta synchronization step type. The rules configuration has changed since the last full synchronization.

User Action
To ensure the updated rules are applied to all objects, a run with step type of full synchronization should be completed."

[DragonsRule]

Ah, I’ve run into that before. I believe the solution was to run this in PS:

Start-ADSyncSyncCycle -PolicyType Delta

But, if that doesn’t work, definitely open a ticket. The O365 support people are, in my experience, very helpful.

[seeyoujs]

Will do! Should I backup anything? Are there any anticipated issues when forcing a full sync?