Set Up On-Prem Domain For Identity Synchronization With Azure AD (AAD)

Set-ADForest -identity "51sec.corp" -UPNSuffixes @{replace="51sec.onmicrosoft.com"}

Get-ADUser –Filter * -Properties SamAccountName | ForEach-Object { Set-ADUser $_ -UserPrincipalName ($_.SamAccountName + "@51sec.onmicrosoft.com" )}

Set-ExecutionPolicy Unrestricted

Another way is through AD administration tolls:

Step 1: Add the new UPN suffix**

1. On the AD DS domain controller, in the Server Manager choose Tools > Active Directory Domains and Trusts.

   Or, if you don't have Windows Server 2012

   Press Windows key + R to open the Run dialog, and then type in Domain.msc, and then choose OK.

   

2. In the Active Directory Domains and Trusts window, right-click Active Directory Domains and Trusts, and then choose Properties.

   

3. On the UPN Suffixes tab, in the Alternative UPN Suffixes box, type your new UPN suffix or suffixes, and then choose Add > Apply.

   

   Choose OK when you're done adding suffixes.

Step 2: Change the UPN suffix for existing users

1. On the AD DS domain controller, in the Server Manager choose Tools > Active Directory Users and Computers.

   Or, if you don't have Windows Server 2012

   Press Windows key + R to open the Run dialog, and then type in Dsa.msc, and then click OK

2. Select a user, right-click, and then choose Properties.

3. On the Account tab, in the UPN suffix drop-down list, choose the new UPN suffix, and then choose OK.

   

4. Complete these steps for every user.

Download and Install Azure AD Connect

Download link: https://www.microsoft.com/en-us/download/details.aspx?id=47594

Custom installation of Azure Active Directory Connect:

Express settings

On the Express Settings page, select Customize to start a customized-settings installation. The rest of this article guides you through the custom installation process. Use the following links to quickly go to the information for a particular page:

• Required Components
• User Sign-In
• Connect to Azure AD
• Sync

Install required components

When you install the synchronization services, you can leave the optional configuration section unselected. Azure AD Connect sets up everything automatically. It sets up a SQL Server 2019 Express LocalDB instance, creates the appropriate groups, and assign permissions. If you want to change the defaults, clear the appropriate boxes. The following table summarizes these options and provides links to additional information.

User sign-in

After installing the required components, select your users' single sign-on method. The following table briefly describes the available options. For a full description of the sign-in methods, see User sign-in.

Connect to Azure AD

On the Connect to Azure AD page, enter a global admin account and password. If you selected Federation with AD FS on the previous page, don't sign in with an account that's in a domain you plan to enable for federation.

You might want to use an account in the default onmicrosoft.com domain, which comes with your Azure AD tenant. This account is used only to create a service account in Azure AD. It's not used after the installation finishes.

Connect your directories

To connect to Active Directory Domain Services (Azure AD DS), Azure AD Connect needs the forest name and credentials of an account that has sufficient permissions.

Azure AD sign-in configuration

On the Azure AD sign-in configuration page, review the user principal name (UPN) domains in on-premises Azure AD DS. These UPN domains have been verified in Azure AD. On this page, you configure the attribute to use for the userPrincipalName.

Domain and OU filtering

By default, all domains and organizational units (OUs) are synchronized. If you don't want to synchronize some domains or OUs to Azure AD, you can clear the appropriate selections.

Verify through Azure AD Users

AD & AAD User Confliction

When you install Azure AD Connect and you start synchronizing, the Azure AD sync service (in Azure AD) does a check on every new object and tries to find an existing object to match. There are three attributes used for this process: userPrincipalName, proxyAddresses, and sourceAnchor/immutableID. A match on userPrincipalName and proxyAddresses is known as a soft match. A match on sourceAnchor is known as hard match. For the proxyAddresses attribute only the value with SMTP:, that is the primary email address, is used for the evaluation.

The match is only evaluated for new objects coming from Connect. If you change an existing object so it is matching any of these attributes, then you see an error instead.

If Azure AD finds an object where the attribute values are the same for an object coming from Connect and that it is already present in Azure AD, then the object in Azure AD is taken over by Connect. The previously cloud-managed object is flagged as on-premises managed. All attributes in Azure AD with a value in on-premises AD are overwritten with the on-premises value. (Sync with existing users in Azure AD)

Here is an example.

In Cloud, there is existing [email protected] account. Password is PasswordT2. Make sure assign O365 license and sent / received a couple of emails. 

In on prem AD, create another user as t2t2 with UPN set to [email protected]. Password is PasswordT2T2

Manual Sync using Synchronization Service Manager installed on On-Prem DC to run a full sync:

Verify from AAD users:

Directory synced status will change from no to Yes. All other properties will be copied from AD to AAD. Password also changed to AD password, not AAD password anymore. Outlook emails still is AAD one, all previous emails kept. 

Troubleshooting

License cannot be assigned to a user without a usage location specified.

Edit user properties and assign a country to this user. Issue should be resolved.

References