A cloud-based identity and access management service for securing user authentication and resource access
AAD Issue with Distribution groups
Hi,
Hopefully someone can help. The below is all lab so any suggestions, I can do with no worry of breaking anything!
I currently have AAD Connect configured for 2 domains. DomainA hosts AAD Connect and DomainB is added in as an additional domain. All working fine from a sync perspective and I have some rules in place that translate DomainA objects to use the DomainB domain etc.
An issue I am having is, I want distribution groups synced from DomainB to utilise a domain that is hosted in DomainA's AAD tenant. I created a rule for users that would map DomainBs UPN to synced DomainA users with no issue.
The rule I have for distis is as below (exported from AAD Connect and Ive highlighted some suspect rows that may be causing an issue):
New-ADSyncRule -Name 'Modify Distribution Group email'
-Identifier '83714098-ac67-40ec-8671-2e20335e5c04' -Description ''
-Direction 'Inbound' -Precedence 42
-PrecedenceAfter '00000000-0000-0000-0000-000000000000' -PrecedenceBefore '00000000-0000-0000-0000-000000000000'
-SourceObjectType 'group' -TargetObjectType 'group'
-Connector '58f89d2b-e399-46fe-b8b3-be7202596888' -LinkType 'Join'
-SoftDeleteExpiryInterval 0 -ImmutableTag ''
-OutVariable syncRule
Add-ADSyncAttributeFlowMapping -SynchronizationRule $syncRule[0]
-Destination 'mail' -FlowType 'Expression'
-ValueMergeType 'Update' **-Expression 'Word([mail],1,"@") & "@DomainA.com"'**
-OutVariable syncRule
New-Object -TypeName 'Microsoft.IdentityManagement.PowerShell.ObjectModel.ScopeCondition'
-ArgumentList 'dn','DC=Domain A AD','ENDSWITH' `
-OutVariable condition0
Add-ADSyncScopeConditionGroup -SynchronizationRule $syncRule[0]
-ScopeConditions @($condition0[0]) `
-OutVariable syncRule
Add-ADSyncRule `
-SynchronizationRule $syncRule[0]
Get-ADSyncRule `
-Identifier '83714098-ac67-40ec-8671-2e20335e5c04'