1

So we do everything via O365 for most part right now, I want to sync the passwords so users can change that themselves. Is Azure AD Connect the way to go, please assist with how to only get passwords to sync with this so users can change themselves via ctrl alt del.

8 Spice ups
2

Azure AD Sync is the correct way to synchronize your local AD users and passwords with O365. Then any changes to local credentials will replicate over to AzureAD (and O365).

Caveat is that any changes to the email user profile will need to be made in AD (I prefer this because it brings most of the user management to ADUC).

1 Spice up
3

If you set up write back they can also change their password online and have it sync back to AD as well.

4

Juanoflo is correct. However, Azure AD will not JUST bring the passwords. Your active AD users will be brought into your O365 account as well. Then, you will have to assign mailboxes to those people. Usually, its just as easy as making sure all the email information in your AD is their actual email address. Its pretty easy. Then those that don’t have email accounts will just show up as unlicensed in the O365 account. Its very simple and easy to use once it is setup. The only difficulty you will have is the possibility that some accounts won’t match up to the already-existing email accounts in O365. That will just take some fine tuning and is very easy to correct.

5

So on the micro admin page for active users, all users are showing twice, one with normal domain and other with the onmicrosoft one, how can I remove those and just keep the regular domain ones.

Also, i tested it and my password is changing on the laptop if I do ctrl alt del as well as in on premise AD, but how can I get that to sync to O365 and all.

6

You will need to merge the onmicrosoft ones with the others. I believe this is what you will need to follow:

https://www.codetwo.com/admins-blog/how-to-merge-an-office-365-account-with-an-on-premises-ad-account-after-hybrid-configuration/

1 Spice up
7

I have to follow this for every single user? Is there a way to re-sync it with Azure tools so it doesnt do this?

8

You need to create an alternate UPN suffix in your AD that matches your email domain and assign that as primary for each user. If not, those “onmicrosoft” accounts will be created. The change will be seamless to the user, they can still log in locally via their normal method and will now have the ability to logon as user@emaildomain.com if they wish.

Also you want to have AADConnect only sync OU’s with user accounts in them - if not it will create O365 accounts for accounts you probably don’t want. (service accounts, etc.)

1 Spice up
9

how can i resync only user accounts if i already have synced everything. Also, I got AD password to match with the COMPUTER but how do i sync with exchange if I do ctrl alt del?

10

The directory sync will auto sync changes every 15 minutes but you can do an on demand delta or full using powershell as well How To Run Manual DirSync / Azure Active Directory Sync Updates - 250 Hello

11

Inside AADC options, if you remove OUs that you don’t want, then do a full sync, the items from those OUs will be removed from O365.

12

i did that but they are still there, I added the UPN with our domain, set it under the Account page as the new UPN i created but still nothing.

onmicrosoft.png
onmicrosoft.png898×296 12.9 KB
13

have you set the onmicrosoft accounts as an alias in the proxyaddresses attribute of the user accounts?

14

I have not I did the opposite, so if I add the user@domain.onmicrosoft.com in proxy address in attrib BUT set the Account drop down list to the @domain.com instead of Contoso.local, that should remove the unlicensed listing from portal in O365?

15

I can’t say for sure, I’ve always prepped and had that configured before a AD sync, but it should theoretcally remove them as long as you are tied on the UPN or the Email address as 365 would see them now as aliases

16

Your UPN should match the .com domain, the email address should also match and proxyaddresses should at a minimum have SMTP:email.com and smtp:email.domain.onmicrosoft.com to specify the onmicrosoft email as an alias.

17

So adding the onmicrosoft to the proxyaddress should drop the onmicrosoft duplicates from portal? Have you seen this occur with all due respect

18

Like I said I’ve never been in your scenario, I’ve always cleaned up AD and had everything in place before doing the sync, so I have never run into your specific scenario. However, I can make a logical assumption that this will work, based not having had the problem when set up the way I suggest. To ensure you are not wasting time though, pick a single user and update the proxyaddresses, do a sync and see if your unlicensed onmicrosoft account disappears. The worst that can happen is it won’t sync and complain of duplicates.

19

This issue is being discussed in two threads, down from three. It really should be one thread:

20

Now that this thread has moved from how to sync into the duplicate issue, which is covered in another thread, I’m going to lock this one. Please reply in the thread linked above.

edit - I just noticed that the above thread is NOT from OP.

This is OP’s other thread on this topic: