Moving users across on-prem

Question

Please help!!!!

We have 3 on-prem domains abc.com.au 123.com and cab.com. They all sync back to single azure ad tenancy and gets assigned same domain for their email address (cab.com). I am trying to move selected users from the first 2 domain to the cab.com one.

I used ADMT tool to copy across the AD object and disabled the source object.

Once disabled moved the source object to a non-sync OU

Went into azure and changed the immutable id for the existing user to the new ID from user in target domain. It has picked up the on-prem attributes correctly in azure. However the groups has not updated (the new onprem object does not have any group), and the mailbox also seem to still seem to be connected to the old on prem account

Answer 1

@Subham Thapa

Thank you for posting this in Microsoft Q&A.

As I understand you have done user migration from one forest to another forest. Now, everything is working in Entra ID and also in on-premises.

You are facing some issues with groups memberships. New object which was created in forest doesn't have the group membership in on-premises as old object.

I think when the object is moved from one domain in on-prem to another domain, group memberships are not carried along with the user.

Usually with if you migrate users using ADMT tool it creates groups associated with the user being migrated accounts and maintains group membership in the target domain.

If the user group membership is intact in on-premises then there will not be any problems with group membership.

And if user is part of particular group in on-premises AD then Entra connect should sync the groups and membership without any issues provided groups are in Sync OU scope.

If you are seeing user not being part of any group in Entra ID then you will have to check in on-preimses if the group is syncing using Entra ID.

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hello,

 

Thank you for posting in Q&A forum.

To further check this issue, please kindly follow below steps:

1.Check if there's anything wrong with the AAD sync.

You could refer to below Microsoft Official Documentation:

https://learn.microsoft.com/en-us/answers/questions/132908/forcing-sync-between-on-prem-ad-and-aad

2.Check if the SPN ofr AD account is matched with the latest domain or not.

3.Check if AAD configuration is configured well on Azure Portal .

To help other customers who may be facing the same issue, please don't forget to vote if the reply is helpful.

Best regards，

Jill Zhou