this post was submitted on 20 Sep 2023
13 points (93.3% liked)

Sysadmin

7664 readers
5 users here now

A community dedicated to the profession of IT Systems Administration

No generic Lemmy issue posts please! Posts about Lemmy belong in one of these communities:
!lemmy@lemmy.ml
!lemmyworld@lemmy.world
!lemmy_support@lemmy.ml
!support@lemmy.world

founded 1 year ago
MODERATORS
 

Hello,

TLDR; Approx 2 years ago we manually created Cloud users on our 365 Tenant to start using Teams. Now we're trying to sync our on-prem AD with AAD and experiencing issues due to pre-existing Exchange Online mailboxes. Cannot delete the mailbox without deleting the user. Can't delete the user because we don't want to lose anything in Teams. Looking for help.

During the pandemic we had a lot of staff start working remotely. Our existing messaging platform was not up to the task and we jumped on the Teams bandwagon, shortly after we bought a mix of Business Basic and Business Standard licenses for all our staff. When applying the licenses to the staff we also inadvertently assigned an Exchange Online license. No big deal we thought at the time because our corporate email MX records point to our on-prem Exchange servers.

Fast forward to now and we're in the process of trying to sync all on-prem users to Azure AD so we can ultimately migrate our mailboxes off of our on-prem Exchange 2013 servers and on to Exchange Online. We've run into an issue that Microsoft support is having trouble solving. Because the cloud users were manually created before we setup AAD Connect and configured Hybrid Exchange, the Tenant knows nothing about the on-prem mailboxes. I cannot sync on-prem users to our Tenant because a mailbox exists for the user already. I cannot delete the Exchange Online user mailbox without deleting the user. Deleting the user will cause data and permission loss with Teams.

The sync process works fine if the user doesn't exist on the Tenant first, or if the 365 user doesn't have a pre-existing mailbox.

Hoping to find someone who's been in a similar situation and was able to solve it. Information online is sparse for this scenario and I'm not able to find anything that helpful.

you are viewing a single comment's thread
view the rest of the comments
[โ€“] misanthropy@lemm.ee 7 points 1 year ago (1 children)

You just need to "hard match" the existing AD accounts with the 365 accounts, using immutableID. Use connect-msolservice cmdlet in PowerShell. immutableID ties the AD object to the 365 one.

Heads up though, you may run into issues if the usernames don't match. This may be time consuming if you have tons of users, but I know of no other good solution

[โ€“] aeluon@programming.dev 1 points 1 year ago

this is the way. done it a few times for clients. not exactly fun but it will work.