Merging mailbox EO from AAD with local domain account

Question

Hi everyone,

I have a tenant in EO with 50 mailbox accounts. Now I want to connect local AD with AAD via Azure AD Connect.

How to merge correctly AAD account with local AD where users can use the mailbox via local AD credentials?

Answer 1

You have two options when it comes to "matching" on-premises accounts with AAD ones:

1) Soft-match, based on the PrimarySMTPAddress value is generally the easiest option. It does have some prerequisites though, so make sure you cover all the details as listed here: https://support.microsoft.com/en-us/topic/how-to-use-smtp-matching-to-match-on-premises-user-accounts-to-office-365-user-accounts-for-directory-synchronization-75673b94-e1b8-8a9e-c413-ee5a2a1a6a78
2) Hard-match, based on the objectGUID (or generally speaking the sourceAnchor, which can also be set as the value of mS-DS-ConsistencyGuid). This is a bit more complicated as it requires you to calculate and populate the ImmutableId value. Here's an example:

Get-ADUser -Filter * | select UserPrincipalName,ObjectGUID,@{n="ImmutableID";e={[System.Convert]::ToBase64String($_.ObjectGUID.tobytearray())} } | export-csv -nti C:\immutableID.csv  

$csv = import-csv C:\immutableID.csv  
$csv | ? {$_.UserPrincipalName -ne ""} | % { Set-MsolUser -UserPrincipalName $_.UserPrincipalName -ImmutableId $_.ImmutableID}  

Answer 2

Hi see this:
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-existing-tenant

Answer 3

Thanks all for your reply, I'll check all of it this week and back here with answer or other questions.

Answer 4

Hi @Vasil Michev & @Andy David - MVP ,

sorry for the delayed answer.

I try to use soft merging (SMTP merge) but I had errors in AADC.

I have got an Azure AD account "martin.john@Company portal .com" with a Bussines Standard license, in Local AD I create an account with SAMA "martin.john" and add to the attribute proxyAddresses: "SMTP:martin.john@Company portal .com" then when it trying to sync I have error:

Next, I create an account with SAMA "m.john" in Local AD with the attribute proxyAddresses: "SMTP:martin.john@Company portal .com" and it's sync correctly, but when I tried to change the license from AAD account "martin.john" to synchronized "m.john" I've got this:

Uniqueness constraint violation.

Any suggestions?