Hi everybody, We're facing with next scenario: Company have only 365 tenant and know they growing and need their own on-prem Domain. we don't want to create new users on-prem cause then they would have different password for O365 and on-prem. We would like to sync all users & groups from O365 to on-prem domain, and then change the sync way which all users will sync from on-prem to O365 tenant via AdSync all this for SSO purpose. is there any written official procedure to get it done peacefully and without downtime? Thanks

That's not possible via the native tools, synchronization is always from on-premises AD to Azure AD. Instead, you can export the set of users/groups via PowerShell and import them in AD. And yes, passwords will not match, but there is no way for you to "read" password values in O365.

for sure :) security is on top always THX

Sync office 365 cloud users to new on-prem domain and configure SSO

Accepted answer

Vasil Michev 94,366 Reputation points MVP

2022-04-29T06:46:58.597+00:00

That's not possible via the native tools, synchronization is always from on-premises AD to Azure AD. Instead, you can export the set of users/groups via PowerShell and import them in AD. And yes, passwords will not match, but there is no way for you to "read" password values in O365.
Please sign in to rate this answer.

2 people found this answer helpful.
Arnold MIshaev 216 Reputation points

2022-04-29T16:35:08.033+00:00

thank for your answer @Vasil Michev

I'm planning to doing project in this way:

1) Export all 365 users to csv with all attributes
2) Import all users to new domain by next command:
Import-Csv "C:\O365users.csv" | ForEach-Object{ $Domain = "@mathieu.company .com"; $UPN = $.Identity+$Domain; New-ADUser -SamAccountName $.Identity -UserPrincipalName $UPN -Name $.Name -DisplayName $.DisplayName -GivenName $.FirstName -Initials $.initials -Surname $.LastName -Department $.Department -Company $.Company -Fax $.Fax -City $.City -State $.StateOrProvince -PostalCode $.PostalCode -Title $.Title -EmailAddress $.WindowsEmailAddress -Office $.Office -OfficePhone $.Phone -MobilePhone $.MobilePhone -StreeAddress $_.StreetAddress -Path "OU=365-Users,DC=Company,DC=local" -AccountPassword (ConvertTo-SecureString "Password" -AsPlainText -Force) -Enabled $True -PasswordNeverExpires $True -PassThru }
3) after that we plan to manually reset all users password to their identically password in 365
4) installing AAD connect on-prem with express settings
5) Configuring filtering as needed
6) and running initial sync

cause smtp ,email and user names attributes will be identity there suppose to be match between on-prem synced users to in cloud users and then it's suppose to match or destroy to 365 users and each user will link to his mailbox right?

Do you think it would work?

I'll be glad to hear any profession opinion :)

Vasil Michev 94,366 Reputation points MVP

2022-04-29T16:51:51.147+00:00

It should work, more or less.

Keep in mind that if those users were previously synchronized from AD, the soft-match process will not trigger (it requires the ImmutableID to be null). If they were created directly in the cloud, the match should indeed happen automatically, due to the matching attributes. If they were synced, either clear the ImmutableID, or use the hard-match method instead.
The other point is passwords - you cannot get a user's password. So you have to reset the value in O365, if you want to ensure a matching one. Obviously, you have to inform the users accordingly and distribute the new password.
And you probably shouldn't provision all accounts with the same password, someone might get opportunistic :)

Arnold MIshaev 216 Reputation points

2022-04-29T17:01:08.45+00:00

Thanks @Vasil Michev

about the password point - after i'll create all users with the same password i'll ask them to reset their password in local AD to the same password in 365

in this way the passwords will match and there is no need to reset them after all the tasks right?

could you see any downtime here?

Vasil Michev 94,366 Reputation points MVP

2022-04-29T18:41:07.34+00:00

You can simply enable Password Hash Sync, so the changed password is automatically synced to O365. Still, make sure each user gets a unique password, otherwise you might have to explain how someone got access to the CEO email :)

Jeetu Poojari 1 Reputation point

2022-09-21T04:51:13.767+00:00

Instead of resetting all passwords in local AD, can I use the Password write-back option in AAD connect if it's available?
Sign in to comment

Sync office 365 cloud users to new on-prem domain and configure SSO

1 additional answer