Unable to update the specified properties for on-premises mastered Directory Sync objects

Question

Environment:
Hybrid with an older Exchange 2010 server.
AD server 2019 running AZURE AD CONNECT (latest version as of March 2022)
I've been adding new employees by creating a new account in AD and syncing with AZURE. No problems there.
Then I go into the Office 365 portal and assign Office for business licenses. A mailbox is then created and working no problem.
Recently, when using the Exchange Admin online, trying to add an alias to ANY mailbox or simply changing the REPLY to SMTP address, I am getting the error:
Error executing request. An Azure Active Directory call was made to keep object in sync between Azure Active Directory and Exchange Online. However, it failed. Detailed error message: Unable to update the specified properties for on-premises mastered Directory Sync objects or objects currently undergoing migration. DualWrite (Graph) The issue may be transient and please retry a couple of minutes later. If issue persists, please see exception members for more information.
This was uncovered when a user sent me an email and it came the onmicrosoft.com domain instead of the company domain. When I looked at the account, I tried to change the REPLY TO back to the default company email and got the error also.
Only 3 employees are effected by the "onmicrosoft.com" issue but I cannot add an alias email to ANY mailbox or change the primary email.
About 2/3 of the employees were migrated from the on premise Exchange server about a year ago and the rest created as mentioned above.
Checking the AD CONNECT LOGS, there are no errors at all when syncing and the online dashboards show no sync errors.
I then tried going into the users AD Properties on Premise and changed the PROXY ADDRESS ATTRIBUTE to change the default reply to SMPT:user@keyman .com. That syncs no problem and shows up in the portal as the primary address but when the user sends an email, it still comes from the onmicrosoft.com domain. I'm at a loss without any log errors to point me in the right direction. The syncing from on premise to online seems to be working fine otherwise.
Thank you

Answer 1

For now, to be supported, yes. You have to have an Exch Server on-prem as long as you are using syncing to Azure from on-prem.
That will hopefully change one day:

https://learn.microsoft.com/en-us/exchange/decommission-on-premises-exchange

Answer 2

A coworker found a way: remove user licenses, change the e-mail in local active directory, sync it to AAD, then re-enable the licenses.

Answer 3

If you have Hybrid Exchange configuration, manage accounts from Exchange Server. If you don't have Hybrid and only have AD plus Exchange Online, then manage accounts through AD.
Each user in AD has property "mail" which corresponds to primary address in Exchange Online. Changing this in AD and syncing with AD Connect, changes the primary address in Exchange Online.
If you want to add aliases to the mailbox in Exchange Online, you have to modify the property "proxyAddresses" in AD. It accepts multiple values, formatted this way :
smtp:secondaryAddress@Company portal .com
SMTP:primaryAddress@Company portal .com

Answer 4

Hello @Martin Gospodinov @Andy David - MVP and all others,

a clarification regarding cutover (or O365 mboxes): once the cutover has been completed and AAD Synch (re)enabled and soft-matching has "fused" the relevant users properly, is it possible to somehow manage the Exchange Online attributes solely online without the On Prem server by additional attribute filtering or does the presence of AD Synch completely exclude this possibility? I know the official answer is still no as you need an on prem Exc Server just for this, but I am wondering this due to the following reasoning (plz bare with me):

if one never installed Exchange On Prem and has only O365 mailboxes and subsequently decides to enable AD Synch for management ease (password synch for ex. which is one of the most wanted things) and soft match the accounts (or even have a prior AD synch and then assign licenses to these accounts for O365), why would one not be able to administer the maibox properties solely online without a prior existing on prem Exchange? It appears that the moment one implements any kind of AD synch the on Prem AD is reputed "in charge" and synched accounts become read only online, even if there are no specific Exchange attributes present in the on prem AD schema.
So I wonder if it is possible maybe prior to the first AD Synch to implement specific attribute filters that will allow the administration of mailbox properties for synched accounts (such as additional SMTP addresses) through Exc online or does the AD Sync "enabling" automatically exclude this completely Azure side?

My impression was that due to a pre-existing On Prem Exchange the AD schema had been updated to support this and implement all the attributes needed by it and thus by synching accounts these attributes would be passed (if not filtered) over to Azure AD thus Exchange Online would not allow you to manage them as they "belong" to an On Prem Exchange and that for me was logical. However what isn't so logical is that if I never have extended the local AD schema with Exchange On Prem as I never have installed a local Exchange and I enable AAD Sync, there is no reason to why once I assign a license hence enable the online Exchange Mbox these attributes shouldn't be administered solely Online - they needn't be synched back to a local AD as with a hybrid setup as there is no local Exchange. If anyone can enlighten me on why MS has yet to accomplish this or what the issues are I would be grateful.

Instead of using the AD Sync provisioning Agent but going full blown AD Sync, a two way sync should be established and allow a "write back" of the edits from the Exch online management (which is what the OP error moans about) - is this an alternative?

Thanks!

Answer 5

If you have Hybrid Exchange configuration, manage accounts from Exchange Server. Untick "Automatically update email addresses based on the email address policy applied to this recipient".
It solved my issue.