Disable AD Connect

Question

Disable AD Connect

azure-training2 31

For the love of god can someone tell me how to turn AD Connect off? This is a training account, the on-prem server doesn't exist anymore, I am just trying to delete everything and kill AD connect. I get emails all the time saying this.. I do not care, how do I stop it from notifying me?

"Your identity synchronization from on-premises is unhealthy"

I am able to connect to my Azure account using PowerShell (connect-azaccount), but none of the Get/Set-Az commands seem to have the ability to enable/disable AD Connect features. I've found tons of articles related to some msol cmdlet set, but I cannot connect to my azure account with that module at all. Tried to contact M$ support, they won't talk to me. Free chat support never loads and they want money.

Regards,
Adam Tyler

Accepted answer

1 additional answer

Your answer

Answer 1

Danny Zollner 10,801 Microsoft Employee Moderator

Hi @azure-training2 - please see the following document: https://learn.microsoft.com/en-us/microsoft-365/enterprise/turn-off-directory-synchronization?view=o365-worldwide

You'll need to install the MSOnline (Azure AD v1 PowerShell) module, and then run Set-MsolDirSyncEnabled -EnableDirSync $false. This will disable directory synchronization on your Azure AD tenant and will convert all synchronized objects (DirSyncEnabled = True) to cloud objects(DirsyncEnabled = False).

azure-training2 31 Reputation points

2020-11-03T18:53:09.11+00:00

Thanks for your post. I've been down the MSOnline PowerShell route.. I can't get past "connect-MsolService".. I get an error saying that "example.com isn't in our system. Make sure you typed it correctly".

This same user account works just fine to connect to Azure PowerShell.. Ie.. "Connect-AzAccount" ..

The logon is the only user that exists in the Azure account, has all rights and was used to originally setup the subscription.

Regards,
Adam Tyler
Danny Zollner 10,801 Reputation points Microsoft Employee Moderator

2020-11-03T18:56:53.463+00:00

Is the account you're using a guest account in the Azure AD tenant? Ie: if you're signing in with user@harsh.com .com in the MSOnline PowerShell module, it won't know what Azure AD tenant to look for as Outlook isn't an AAD work/school domain. If you sign in with an account that originates from the Azure AD tenant you're using (ie: if your tenant is contoso.onmicrosoft.com, sign in with an account such as user@Company portal .onmicrosoft.com) this might unblock you.

The MSOnline PowerShell module is the only way you're going to be able to disable directory synchronization on your tenant, so figuring out what's stopping you from signing in is the next step towards resolving your issue.
azure-training2 31 Reputation points

2020-11-03T19:12:12.973+00:00

Not sure what you mean by a guest account. The account I am using has owner level rights over the entire Azure account instance. I do see that the account doesn't share the same "userdomain.onmicrosoft.com" UPN when compared to new users that get created.

Getting closer. I was able to grant a new user "Global Admin" rights under Azure AD blade. Connected with Connect-msolservice now using new account.

Issued "Set-MsolDirSyncEnabled -EnableDirSync $false" command. Azure console still shows AD Connect is enabled though. Maybe it takes some time to reflect the change....
Danny Zollner 10,801 Reputation points Microsoft Employee Moderator

2020-11-03T19:47:47.27+00:00

Azure AD basic is entirely free. Subscriptions are used for various billed services like Azure IaaS(Infrastructure as a Service, ie: VMs, networking, compute..), but they're not at all required for using Azure AD. Azure AD is used as a mechanism for managing permissions on other resources such as subscriptions, but that's about it.

If you were able to successfully run Set-MsolDirSyncEnabled -EnableDirSync $false, give it some time. Once the Azure AD platform has gone through all of the objects in your tenant and converted them to cloud-mastered rather than synchronized, your Azure AD tenant will show that Azure AD Connect is disabled. You can also confirm the current state of things via the Get-MsolCompanyInformation cmdlet. The results from that will include a line for DirectorySynchronizationEnabled and the current state.
azure-training2 31 Reputation points

2020-11-03T23:55:40.56+00:00

Success!
Mikkel Lund Knudsen 116 Reputation points

2021-06-10T12:17:13.53+00:00

Just wanted to give my 5 cents here.

So we wanted to get rid of On Prem AD, and uinstalled the Azure AD Connect - WITHOUT - doing the : Set-MsolDirSyncEnabled -EnableDirSync $false first - big mistake.

So you want to do this PS before - Set-MsolDirSyncEnabled -EnableDirSync $false

Then afterwards - we couldnt quite complete the step, due to the fact that our accounts tried to auth back to On Prem AD.

We succeeded doing that by running it from a Cloud Only user account that was Global Admin.

True shit.

Answer 2

Najwan Khazem (MEA) 1

i have a question that cant find its answer when we stop the synchrnization and users are covnerted to cloud mode. what will be the password, they can keep using the same AD password or the password is autmtically reset?

Share via

Disable AD Connect

1 additional answer

Your answer