Share via

Active Directory synchronization: Installation

  • Article

Active Directory synchronization for Office 365

As an administrator, you need to do some preparation before you synchronize your local Active Directory to Microsoft Office 365 for enterprises. First, you must decide whether you want to set up single sign-on, also known as identify federation, which enables your company’s users to sign in to Office 365 by using their corporate credentials. Activating directory synchronization should be considered a long-term commitment. After you have activated directory synchronization, you can edit only synchronized objects by using on-premises.

The first time that the Directory Synchronization tool runs, it copies all the relevant objects (user accounts and security groups) to Office 365. Before performing this operation, you must know the number of objects that will be copied so that you can plan ahead for the effect this operation will have on your network response time and the computers that are running Microsoft Exchange Server. These attributes / objects are heavily used for Lync, SharePoint and Info Path work flow.

Objects that have been synchronized from your on-premises Active Directory service appear immediately in the Global Address List (GAL); however, these objects may take up to 24 hours to appear in the Offline Address Book (OAB) and in Microsoft Lync Online.

Steps to follow

  • Consider the pre-requisits..click here to know more and it is listed under Requirements for Directory Synchronization tool
  • An important statistic to consider in the report that is created by the Office 365 Deployment Readiness tool is the estimated total number of objects. This number is listed under Statistic in the Office 365 Deployment Readiness tool. You must follow the recommendations made by the tool if you exceed the default total number of objects that the directory synchronization installation allows.
  • Update your Active Directory Picture – Free Tool – before your directory syncronization. This picture will be used on your profile AD pictures for Lync, SPS etc. Click here to know more
  • To activate directory synchronization, use the following steps:
    1. Install and run the Microsoft Office 365 Deployment Readiness Tool.
    2. In the Office 365 header, click Admin.
    3. On the Admin page, in the left pane, click Users.
    4. At the top of the page, click the link next to Active Directory synchronization.
    5. On the Set up and manage Active Directory synchronization page, under Activate Active Directory synchronization, click Activate.
  • Setup user permission: When you install the Directory Synchronization tool, the Directory Synchronization Configuration wizard creates a service account to read from your local Active Directory and write to the Office 365 synchronization database. On the Microsoft Online Services Credentials page of the Microsoft Online Services Directory Synchronization Configuration Wizard, you must provide the credentials for an account with administrator permissions on your company’s Microsoft Office 365 for enterprises subscription. These credentials must be provided in the following format:
    • Someone@example.com
    • You can provide credentials for any valid administrator account in your company’s Office 365 subscription, or you may create a special account dedicated to this use.
    • When the directory synchronization service runs, it reads from your local Active Directory and writes to Office 365 using the Office 365 administrator credentials that you provided
    • If you add a domain to your Active Directory forest, you must run the Configuration Wizard again to add the new domain to the list of domains to be synchronized.
    • To run the Directory Synchronization tool, you must have administrator permissions for the following:
      • The computer running the Directory Synchronization tool.
      • Your company’s local Active Directory
      • Your company’s Office 365 account
  • Do not install the Directory Synchronization tool on the same computer that has Active Directory Federation Services (AD FS) 2.0 installed on it.
  • To install the Directory Synchronization tool, follow these steps from the Office 365 portal.

    1. In the header, click Admin.

    2. On the Admin page, in the left pane, click Users.

    3. At the top of the Users page, click the link next to Active Directory synchronization.

    4. Under step 4, select either Windows 32-bit version or Windows 64-bit version, click Download, and follow the instructions to save the installation file on your computer. If necessary, copy the installation file to the computer that it will be installed on.

    5. On the last page of the installation program, select Start Configuration Wizard now, and then click Finish.

      The Microsoft Online Services Directory Synchronization Configuration Wizard starts.

  • IMPORTANT NOTE: Installing the Directory Synchronization tool creates the MSOL_AD_SYNCaccount in the standard Users organizational unit of the local Active Directory directory service. This account is used by the Directory Synchronization tool to read the local Active Directory information. Do not move or remove this account. Moving or removing this account will cause synchronization failures.
  • Directory synchronization uses this service account to read and synchronize your local Active Directory information. The Configuration Wizard also sets up recurring synchronizations every three hours from your local Active Directory to your Office 365 directory.
  • After you have configured and synchronized the directory synchronization tool for a given cloud tenant organization, you cannot configure the same directory synchronization installation to populate other cloud tenants. If you have already installed and configured the directory synchronization tool and you have signed up for another Microsoft Online Services tenant organization, you must install a new instance of the directory synchronization tool.
  • To configure directory synchronization, follow these steps.
  • To start the Configuration Wizard, do one of the following:
    1. If you are setting up directory synchronization for the first time, on the last page of the Microsoft Online Services Directory Synchronization Setup wizard, select the Start Configuration Wizard now check box, and then click Finish.
    2. If you are updating the configuration of directory synchronization, click Start, click All Programs, click Microsoft Online Services, click Directory Synchronization, and then click Directory Sync Configuration.
    3. On the Microsoft Online Services Credentials page, type your Microsoft Online Services Administrator Credentials, and then click Next.
    4. On the Active Directory Credentials page, type your Active Directory Enterprise Admin Credentials, and then click Next.
    5. On the Exchange hybrid deployment page, you can activate the Exchange hybrid deployment features if you have Exchange Server 2010 SP1 installed.
  • Force directory synchronization: If you don’t want to wait for the recurring synchronizations that occur every three hours, you can force directory synchronization at any time. For example, if an employee’s employment is terminated, you may want to immediately disable or delete their Active Directory account in the cloud if the account was created there, or on-premises if the account was created locally, and then force directory synchronization to prevent that employee’s continued access to your email system and network resources.

Force directory synchronization using Windows PowerShell

You can use the directory synchronization Windows PowerShell cmdlet to force synchronization. The cmdlet is installed when you install the Directory Synchronization tool.

  1. On the computer that is running the Directory Synchronization tool, navigate to the directory synchronization installation folder. By default, it is located here: %programfiles%\Microsoft Online Directory Sync.
  2. Double-click DirSyncConfigShell.psc1to open a Windows PowerShell window with the cmdlets loaded.
  3. In the Windows PowerShell window, type Start-OnlineCoexistenceSync, and then press ENTER.

Force directory synchronization using the Configuration Wizard

You can also force synchronization by running the Microsoft Online Services Directory Synchronization Configuration Wizard; however, you will have to complete the entire wizard to do so, including entering your credentials again.

  1. On the computer that is running the Directory Synchronization tool, click Start, click All Programs, click Microsoft Online Services, click Directory Synchronization, and then click Directory Sync Configuration.
  2. Follow the instructions in the wizard, and provide the requested credentials.
  3. On the Finished page of the wizard, leave the Synchronize directories now check box selected, and then click Finish.

When directory synchronization is installed, the local Active Directory becomes the master for all changes to the synchronized mail-enabled objects in Office 365.

Verify directory synchronization after forced synchronization

  1. Ensure that there is a valid email address for your organization’s Office 365 technical contact.
  2. Sign in to Office 365 with service administrator credentials.
  3. Verify the additional properties of a specific user account (such as Job title, Department, or Street address) that will be synchronized from your local Active Directory to Office 365.
  4. Verify that you cannot edit the additional properties of that user account in Office 365.
  5. Log on to your local Active Directory with the permissions needed to edit user accounts, contacts, and distribution groups.
  6. In your local Active Directory, make a simple but obvious change to one of the additional properties of the specific user account.
  7. Open the Microsoft Online Services Directory Synchronization Configuration wizard.
    1. Provide the information requested on the wizard pages.
    2. On the Finished page, select Synchronize directories now, and then click Finish.
  8. When directory synchronization is complete, view the additional properties of the user in Office 365, and verify that the change you made to the additional properties of the specific user account in your local Active Directory have been synchronized to Office 365.