Help with AADConnect Expressions

ShaunWI 96

In our hybrid Dev environment, we have followed these instructions to add a custom attribute to on-prem AD signifying Guest/Member, and have that syncing into AADConnect & out to Azure as UserType. This works for provisioning on-prem users as Guests in Azure, but it gives them <On-Prem UPN Prefix>@<tenant name> UPNs. We would like the Guest UPNs to be provisioned like "invited" Guests are - with the Guest user's email address in the prefix (with @ replaced with _), followed by #EXT#@<tenant name>. Does anyone know how to do this? I assume we need to write some very long IIF statement. I'd also like to convert the custom AADConnect output rule from "Direct" to "Expression" where it will write the value from the custom attribute if it is populated, otherwise write "Member". Can anyone help with the need custom expression language? Thanks. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-change-the-configuration#enable-synchronization-of-usertype

Marilee Turscak-MSFT 36,846 Reputation points Microsoft Employee

2020-11-07T21:29:54.317+00:00
I'm checking with the product team to see if there is a good way to do this.

I've never tried to do this for guest users, but it seems like you would be able to go through the steps for Changing The UPN Suffix For An Entire Domain Via PowerShell:

Import-Module ActiveDirectory $oldSuffix = "canitpro.local" $newSuffix = "rebeladmin.com" $ou = "DC=canitpro,DC=local" $server = "DCM1" Get-ADUser -SearchBase $ou -filter * | ForEach-Object { $newUpn = $_.UserPrincipalName.Replace($oldSuffix,$newSuffix) $_ | Set-ADUser -server $server -UserPrincipalName $newUpn }
Marilee Turscak-MSFT 36,846 Reputation points Microsoft Employee

2020-11-09T19:14:52.48+00:00

Response from the PG:

This is not possible because by setting the UserType to "Guest" to a synced user you are not "converting" the synced user into guest (The portal will display the user as a guest, yes), but behind the scenes, the synced user continues to be a synced user (meaning its source of authority is on-prem AD) and that's why you see the UPN as the one on-prem and not as a real guest user's UPN #EXT. That's pretty much like when you change the UserType for a guest user to member, it's just a graphical thing that the portal shows the guest as member, but in the back end, the guest user continues to be a guest user and same restrictions to guest users apply for that account. Regarding the UPN, you could build a custom rule that modifies the users' UPN to be with the #EXT format, yet, it doesn't mean the user is guest, you're you faking it to be one. What's the end-goal with this?
Marilee Turscak-MSFT 36,846 Reputation points Microsoft Employee

2020-11-09T19:16:37.02+00:00

The PG also said if you are a Premier customer, you should get in contact with your CSAM, and CSAM with Microsoft Consulting Services. Their may be customizations the product group is not aware of which better suit these needs. Custom solutions are either not self-supported or supported by Microsoft Consulting Services.
ShaunWI 96 Reputation points

2020-11-09T19:41:45.783+00:00

Thanks for the replies. My main concern is that synchronized Guest users be able to login to our tenant using their email address as username, like invited Guests can do. I thought this meant that their UPN's needed to match (ie: be in that <email_prefix>_<email_suffix>#EXT#@<tenant name> format). Is this not the case?
James Hamil 24,666 Reputation points Microsoft Employee

2020-11-26T00:45:06.937+00:00

Hi, do you still require assistance? If not, please mark the answer as verified.

Thank you,
James

Accepted answer

ShaunWI 96 Reputation points

2020-11-12T21:36:34.657+00:00

I was told that creating Guest users via AADConnect synchronization would not result in usable Guest accounts, because Azure would not know where the auth authority for the Guest account would reside. I have moved onto implementing a method for exclusion of individual objects from AADConnect sync, via custom attribute & custom AADConnect sync rule to set cloudFiltered to True.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Help with AADConnect Expressions

0 additional answers

Your answer