• Preparing Active Directory Accounts for Migration to Office 365

    So, you think you’re ready for the jump to Office 365?  You have done your research; licensing, cost-savings, administration, migration strategies, best practices, etc. You have weighed the costs of doing the migration in-house or choosing a vendor to assist. What’s next?

     

    Ensuring a stress-free migration for you and your users will need 3 things:

     

    • Smart planning
    • Smart decisions
    • Time

     

    There are many things recommended to make the migration go smoothly. One key piece of smart planning is ensuring the Active Directory accounts, which are migrating to Office 365, are prepared for the migration. Successful directory synchronization between your on-premise directory and Office 365 requires that attributes are properly configured.

     

    Microsoft Active DirectoryThe following 5 tasks should be completed in Active Directory to plan for a smooth migration:

     

    1. Active Directory Cleanup Tasks

     

    Perform the following cleanup tasks in your on-premise directory:

      • Ensure that each user has a valid and unique email address in the proxyAddress Field
      • Remove Duplicates in the proxyAddress field
      • Ensure each user has a valid and unique value for the userPrincipalName atrribute in the user’s user object
      • For best use of the global address list (GAL), be sure the information in the following attributes is accurate:
        • givenName
        • surnamedisplayName
        • Job Title
        • Department
        • Office
        • Office Phone
        • Mobile Phone
        • Fax Number
        • Street Address
        • City
        • State
        • Zip
        • Country

     

     

    2. Directory Object and Attribute Preparation

     

    Directory synchronization will fail if some of the Active Directory users have one or more duplicate attributes. If there are duplicate values, the first user with the value is synchronized. Subsequent users will not appear in Office 365. The following attributes should need prepared:

              • Mail
                • Attribute must be unique within the directory
              • mailNickname (Exchange alias)
                • Cannot begin with a period (.).
                • Attribute must be unique within the directory
              • proxyAddresses
                • Can accept multiple values
                • Value must not contain a space
                • Attribute must be unique within the directory
                • Invalid characters:
                  • [ \ “ | , / : < > + = ; ? * ]
                • sAMAccountName
                  • Maximum characters: 20
                  • Attribute must be unique within the directory
                  • Invalid characters:
                    • [ \ “ | , / : < > + = ; ? * ]
                  • targetAddress
                    • Maximum characters: 255
                    • Value must not contain a space
                    • Attribute must be unique within the directory
                    • Invalid characters:
                      • [ \ “ | , / : < > + = ; ? * ]
                    • All SMTP addresses should comply with email messaging standards
                  • UserPrincipalName
                    • Must be in the Internet-style sign-in format: joe@contoso.com
                    • Invalid characters:
                      • [ \ “ | , / : < > + = ; ? * ]
                    • The @ character is required in each value
                    • The @ character cannot be the first character
                    • The user cannot end with a period (.), &, a space, or @
                    • Routable domains must be used, local or internal domains cannot be used

     

    3. Prepare the userPrincipalName Attribute

     

    Active Directory is designed to allow the end users to sign in to the directory by using either sAMAccountName or userPrincipalName. End users can sign in to Office 365 by using the user principal name (UPN) of their work or school account. Directory synchronization attempts to create new users in Azure Active Directory by using the same UPN that’s in the on-premises directory. The UPN is formatted like an email address. In Office 365, the UPN is the default attribute that’s used to generate the email address. It’s easy to get userPrincipalName (on-premises and in Azure Active Directory) and the primary email address in proxyAddresses set to different values. When they are set to different values, there can be confusion for administrators and end users.

     

    4. Add an Alternative UPN Suffix (if needed)

     

    There may be a need to add an alternative UPN suffix to associate the user’s corporate credentials with the Office 365 environment. A UPN suffix is the part of a UPN to the right of the @ character. UPNs can contain letters, numbers, periods, dashes, and underscores, but no other types of characters.

     

    5. Match the On-Premise UPN with Office 365 UPN

     

    If directory synchronization is already setup, the user’s UPN for Office 365 may not match the user’s on-premise UPN that’s defined in the on-premise directory service. This can occur when a user was assigned a license before the domain was verified. To fix this, use PowerShell to fix duplicate UPN to update the user’s UPN to ensure that the Office 365 UPN matches the corporate user name and domain. When updating the UPN in the on-premise directory service and to have it synchronized with the Azure Active Directory identity, remove the user’s license in Office 365 prior to making the changes on-premise.

     

    It is common for the on-premise domain to have a .local extension. In these cases, it is required to add an alternate UPN suffix to the .local domain which matches the email addresses of the users begin migrated. For example, if the local domain is contoso.local, but the email domain is contoso.com (i.e. users have email addresses of joe@contoso.com) an alternate UPN suffix is required on the local domain. In addition, the user’s primary UPN needs to be modified to reflect the UPN which needs to match the email domain.

     

    IdFix Tool

     

    Microsoft provides a tool to make this process easier, it is called the IdFix tool. In fact, Microsoft does not recommend making the above changes without the tool. IdFix can find errors, report on errors, and even allow to take actions to edit or remove the attributes. All prior to attempting synchronization.

    IdFix DirSync Error Remediation

     

    Conclusion

    These are the main values in Active Directory which need to be validated or modified to ensure a smooth transition to Office 365, and IdFix can assist in identifying these values.

     

    Categories

  • Archives

  • Social

    • GET IN TOUCH

    EMAIL: info@zunesis.com

         

        

    NAVIGATION

    CORPORATE OFFICE

    Zunesis, Inc.
    4B Inverness Ct E Suite 100,
    Englewood, CO 80112
    (720) 221-5200

    Las Vegas
    6671 Las Vegas Blvd S
    Building D Suite 210, Office 260
    Las Vegas, NV 89119
    (702) 837-5300

    Copyright © 2023 Zunesis. All Rights Reserved. | Website Developed & Managed by C. CREATIVE, LLC