How to Sync an Existing Office365 Tenant into a New Active Directory Domain

How to Sync an Existing Office365 Tenant into a New Active Directory Domain

Part 1 – Add UPN Suffixes into Active Directory

Log in to the portal as a global administrator and navigate to settings then domains. Make a list of all the custom domains you are using, not including the default onmicrosoft.com. These will be added as UPN suffixes into the active directory so that users can have the same username in the local AD as in Office 365.


Log into a domain controller and open Active Directory Domains and Trusts. Right-click on the root and click on Properties. This will allow you to add the UPN suffixes. Add all of the custom domains you have listed in the domains section in Office 365 except for the onmicrosoft.com domain.

Here we add office365lab.co.uk and press OK.


Part 2 – Check all user accounts and groups have a logon domain

Check each user account has one of your custom domains included in the user name and not the onmicrosoft.com domain.


If any user accounts have a username that is not a custom domain, then go into the account, update the username, and save the changes. It's okay to have a cloud admin account with is cloud only and has the onmicrosoft.com. If you want to sync everything else into your active directory, please make sure all the accounts have a logon domain that matches one of your custom domains.


As well as all user accounts do the same for each group in the Office 365 tenant.



Part 3 – Create an object in the active directory

Now it's time to go down your list of user accounts in the portal and recreate them in your local active directory. Pay special attention to the user's names, primary email addresses, and aliases.



On one of your domain controllers open up active directory users and computers and create a new user object.


Enter the details exactly as you see them in the Office365 portal and ensure you set the user logon name suffix to match the Office 365 logon name in the portal.


Set a password and press Next, it's not too important what the password is here because it will need resetting after the initial sync before the user can log on.


Now, ensure the primary address of the user in the portal is entered on the general tab in the e-mail field.


Next, go to the Attribute editor and find the proxyAddresses attribute. Here is where you enter all of the email addresses assigned to the account so add any email aliases which are listed on the account in the portal.

The primary email address must be prefixed with SMTP: in capitals and all other aliases should be added in lowercase smtp: This is important so pay attention when adding all of the addresses.

The primary address (aka the send as address) has SMTP: prefixed on it and all others have a lowercase smtp:


Part 4 – Install Azure Active Directory Connect (AAD Connect)

Download the latest version of the AAD Connect tool onto one of your domain controllers or a member server which will host the sync software.

https://www.microsoft.com/en-us/download/details.aspx?id=47594

Run the installer, agree to the terms, and select Continue.


We are going to go for an express setup here but if you want to explore the advanced options go for it. Select Express if you want it to work using this guide.


Enter the login credentials of a global administrator in the Office365 tenant. Just remember that if you update the password to this account you will need to rerun the AAD Connect configuration wizard to update the password.


Enter the domain administrator account and the same applies as above, if you update the password then rerun the wizard.


The wizard will verify that your custom domains have been added as UPN suffixes. If you followed part 1 of this guide your good to go.


Press install and let the configuration complete which will take a few minutes.


Once AAD Connect has been installed it will kick off a sync. Leave the system for about 20 minutes to allow this initial sync to complete in the background.

You can test if the sync is working correctly by adding a new email alias into one of your active directory user accounts and see if those changes sync into the Office 365 portal. We can see all of the additional aliases we added earlier in this guide have synced into the 365 portal!

Every change you make from now on will sync with Office 365 every 30 minutes by default. You won't see the changes right away so be patient, or open PowerShell on the domain controller and type the following command to force a sync.


Start-ADSyncSyncCycle -PolicyType delta