Directory Synchronization issues for Office 365 users accounts

I've setup AD DirSync for my Office 365 Domain to enable password synchronization. However, no users are appearing in O365. In the Synchronization Service Manager on my server, the local domain connector shows the correct 286 users for uploading but I don't think I have ever seen any users on the O365 domain connector for import, and, certainly, none have ever arrived.

O365 reports "Last synced less than an hour ago" and "Active Directory synchronization is activated. "
west-comAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Vasil Michev (MVP)Commented:
Check the Metaverse tab, search for particular user there and check the properties to find out if/why he has been filtered out. This article lists the attributes that need to be configured for a user to be synced: http://social.technet.microsoft.com/wiki/contents/articles/19901.dirsync-list-of-attributes-that-are-synced-by-the-azure-active-directory-sync-tool.aspx#How_directory_synchronization_determines_what_isn_t_synced_from_the_on-premises_environment_to_Windows_Azure_AD

And of course, double-check if any additional filtering is in place.
0
west-comAuthor Commented:
I've taken a sample of users who should be synched:

User objects are filtered if:
•mailNickName starts with "SystemMailbox{" -checked not relevant
•mailNickName starts with "CAS_" AND mailNickName contains "{"  -checked not relevant
•sAMAccountName starts with "CAS_" AND sAMAccountName has "}"  -checked not relevant
•sAMAccountName equals "SUPPORT_388945a0" -checked not relevant
•sAMAccountName equals "MSOL_AD_Sync" -checked not relevant
•sAMAccountName isn't present -checked They all have one
•isCriticalSystemObject is present -checked  <not set>
•msExchRecipientTypeDetails == (0x1000 OR 0x2000 OR 0x4000 OR 0x400000 OR 0x800000 OR 0x1000000 OR 0x20000000) - checked. No attribute. Exchange has never been installed in this domain


With regards to filtering:
I have setup AD DirSync only to sync users beneath a certain OU. THis OU contains all the users I wish to synchronize. I've checked this again and it looks correct.
When I installed DirSync I asked it to synchronize the members of a group "gOffice365Accounts".  Users are members of this group. I cannot see how to change this.
0
Vasil Michev (MVP)Commented:
Oh, so you are using the new AAD Connect preview build? Guess you missed the part that it's not supported to run it in Production yet :)

You can only add one group when running the setup wizard and to change/remove it you have to rerun the wizard. It works in combination with other type of filtering, and I'm not so sure it plays well with OU filtering. Doesnt work with nested groups, they need to be immediate members. If users get removed from the group, they will be removed from Azure AD as well.

I would remove the OU filtering and try again. As advised before, check the status of one user via the Metaverse tab options, it will show you for certain if and why it's being filtered.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

west-comAuthor Commented:
The group I am using does not have nested groups.

I certainly did miss the part about not supported in production. Would you recommend uninstalling and installing an earlier version?
0
west-comAuthor Commented:
I've looked on the Metaverse Search tab and checked a sample user.  I cannot see anything about filtering.
0
west-comAuthor Commented:
I had opened a ticket to Microsoft for a solution to this. Their engineer took control of my session and did some Magic, of which I was unable to follow it all, and things now work.

Thank you Microsoft and thank you Vasil for your help. I only wish I could report back on what Microsoft actually did to fix things.
0
west-comAuthor Commented:
Apart from Microsoft doing the final fix, This was the most helpful information.
0
Vasil Michev (MVP)Commented:
Oo they are allowed to use remote control now? :)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.