Disable Directory Synchronization

Question

Azure AD Connect was uninstalled before disabling directory synchronization. The tenant is still showing OnPremisesSyncEnabled = True. MSOnline authentication is blocked in our tenant, so Set-MsolDirSyncEnabled cannot be used.

Please disable directory synchronization at tenant level.

Answer 1

To disable directory synchronization for your tenant, you can use the Microsoft Graph PowerShell module. Since you mentioned that Azure AD Connect was uninstalled and you cannot use Set-MsolDirSyncEnabled, you can follow these steps:

1. Install Microsoft Graph PowerShell if you haven't already. You can find instructions on how to install it in the Microsoft documentation.
2. Connect to Microsoft Graph using the following command:

      Connect-MgGraph -Scopes 'Organization.ReadWrite.All'
   

3. Disable directory synchronization by running the following command:

      $organizationId = (Get-MgOrganization).Id
      $params = @{ onPremisesSyncEnabled = $False }
      Update-MgOrganization -OrganizationId $organizationId -BodyParameter $params
   

4. Check the status of directory synchronization to ensure it has been disabled:

      Get-MgOrganization | Select OnPremisesSyncEnabled
   

   This command should return False once the deactivation process is complete, which may take up to 72 hours depending on the number of objects in your tenant.

Make sure to monitor the status periodically until it reflects the change.

---

References:

• Turn off directory synchronization for Microsoft 365
• Can't manage or remove objects that were synchronized through the Azure Active Directory Sync tool