[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 31
  • Last Modified:

o365 ad integration after tenat to tenant migration

Ideas how to do o365 ad integration in this spceial scenario

The customer had a running ad-integrated o365 system but because the onmicrosoft.com domain name had a spelling error we were forced to migrate emails to new tenant.

I'm wodering will there be any challanges when we do the ad-inegration. All users in the new o365 tenant has now temporary passwords (and the user name is right now onmicrosoft.com -type) and they have not logged into new o365 account. I wasn't able to verify the domain at the o365 because the portal stated that the domain is allready in use.

The plan is that on next Monday the new o365 system is in use and ad-integrated.

The goal is that when the users create new Outlook profile (on next Moday) the password is ad integrated - the same one they have used so far.

They have only one  server and it is a Win Server 2012 R2 Standard.
0
RimFire007
Asked:
RimFire007
  • 7
  • 4
  • 3
2 Solutions
 
Vasil Michev (MVP)Commented:
Well you probably want to use the same domain in the new tenant, as I imagine it's used in some of the on-premises attributes. So remove it from the old tenant and add it to the new one as the first step. Then, simply enable dirsync and any additional integration features you need, such as password sync. Since you mentioned migration, if the user object are already provisioned in the new tenant, you will have to use one of the methods to "match" them against the on-prem objects:

Soft-match, based on Primary SMTP: http://support.microsoft.com/kb/2641663
Hard-match, based on ObjectID: http://blogs.technet.com/b/praveenkumar/archive/2014/04/12/how-to-do-hard-match-in-dirsync.aspx
0
 
Lawrence TsePrinciple ConsultantCommented:
You will need to consider a few things:
1. will there be any user looking for data migration between tenant
2. you will need to remove all user dependency of your external DNS domain from old tenant, like email address
3. you will need to re-establish DirSync between your on premise AD and new tenant Azure AD
4. you will need to add and verify your DNS domain in new tenant, and it might take time

Instead of "big bang" cutover, I would like to suggest you can gradually move users from old tenant to new one, by means of email address redirection, "reply to" address, and DNS alias., etc.  "Big bang" can be OK, but when something wrong happen this can make all of your customer end user suffer.
0
 
RimFire007Author Commented:
Thanks Vasil

Yes surely I will use the same domain name for the new tenant. Just the onmicrosoft.com domain name will be new (and now without spelling error).

I noticed from my old notes that when I at 2015 did the AD-integration I used the Azure AD Connect tool. It is still on the desktop of the server. What if I use it again?

When I click it I can see "Azure AD Connect Message.jpg":

And when I click Configure I can see "Azure AD Connect Additional tasks.jpg"

It seems to me that this tool is somehow locked to the wrong tenenat so I can't use it.

"Then, simply enable dirsync and any additional integration features you need, such as password sync. "
What tool you suggest me to use for Dir Sync (AD-integration)?
Azure-AD-Connect-Message.JPG
Azure-AD-Connect-Additional-tasks.JPG
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
RimFire007Author Commented:
Futher more

I use BitTitan for mailbox migration and the mails are allready migrated to the new tenant. There are apx. 20 mailboxex including 5 shared mailboxes.
0
 
RimFire007Author Commented:
Lawrence

1. will there be any user looking for data migration between tenant
Planning to start using the new tenant tomorrow or maybe on Sunday. I can adivse users not to use emails during weekend.
 2. you will need to remove all user dependency of your external DNS domain from old tenant, like email address
How to do this? Just provide correct DNS Records (those I get form the new o365 portal) to external DNS provider?
 3. you will need to re-establish DirSync between your on premise AD and new tenant Azure AD
What tool should i use? Se my previous email wondering the same issue
 4. you will need to add and verify your DNS domain in new tenant, and it might take time
Surely I need to do that. SUppose it wont take more than 1-2 hours if everything goes smoothly.
0
 
Lawrence TsePrinciple ConsultantCommented:
If you want to reuse the same computer for Azure AD Connect, the binary needs to be uninstalled and reinstalled.
0
 
Vasil Michev (MVP)Commented:
2015 was long time ago, you should update the AAD Connect tool. You need to reconfigure it any way if you are switching tenants, so just download the latest version and install it.

If you are using a third-party migration tool, your users are most likely already provisioned in the new tenant. Thus you need to make sure that the objects are provisioned in a way that will "match" what's on-premises. I provided you the two options above.
0
 
Vasil Michev (MVP)Commented:
Oh, and this script makes it easier to remove a domain: https://gallery.technet.microsoft.com:443/How-to-remove-a-custom-6fe91693
0
 
RimFire007Author Commented:
Thanks Lawrence

I checked my old notes again and actually I used a tool called Directory Sync Configuration. It seems that the end users has played around with the "Azure AD Connect tool" but I just uninstall it and download the newest one and use it for DirSync, right?
0
 
Lawrence TsePrinciple ConsultantCommented:
Yes, just download it again from your new tenant portal and use it for DirSync.

Cheers.
0
 
RimFire007Author Commented:
Vasil

"If you are using a third-party migration tool, your users are most likely already provisioned in the new tenant. Thus you need to make sure that the objects are provisioned in a way that will "match" what's on-premises. I provided you the two options above."
Yes. The migrated users has licenses and all emails are transferred.

Surely before i start attempts to Dir Sync happen:
  1. I verify the domain
  2. Make the primary user name to be the real one (not onmicrosoft.com)
  3. Pass the DNS Records to the external DNS keeper

and finally match" the usernames against the on-prem objects. Actually I think that this is covered on above steps.

I checked the ADUC and the user accounts are set to be firstname.lastname@realdomainname.com (not realdomainname.local) so they are fine think.

I think I'm good to go.
0
 
Lawrence TsePrinciple ConsultantCommented:
1. will there be any user looking for data migration between tenant
> Planning to start using the new tenant tomorrow or maybe on Sunday. I can adivse users not to use emails during weekend.
>> As an ideal case, it's better to have mailbox migrated to new tenant after stopping mail intake.  In this case, if your mailbox is already in new domain, I just aware new mail coming into old tenant will remain on old mailbox and lost after migration.

A better way is to cutover the mail path first, but in order to do that, you need to migrate out the DNS domain from old tenant and migrate into the new tenant.  Please see "2" on how to do it.
 
2. you will need to remove all user dependency of your external DNS domain from old tenant, like email address
> How to do this? Just provide correct DNS Records (those I get form the new o365 portal) to external DNS provider?
>> Go to email address of all users, make sure delete all the email address of @your_email_domain  and change them all to @old_tenant.onmicrosoft.com.  Or else, when you migrate out your DNS domain, the wizard will give you error.
 
3. you will need to re-establish DirSync between your on premise AD and new tenant Azure AD
> What tool should i use? Se my previous email wondering the same issue
>> As said before, Azure AD Connect will be good enough.
 
4. you will need to add and verify your DNS domain in new tenant, and it might take time
> Surely I need to do that. SUppose it wont take more than 1-2 hours if everything goes smoothly.
>> Due to "1", you might want to do this before actual cutover and EVEN before mailbox porting from old tenant to new tenant.  Please think of the following dependencies:

1. If mailbox data is moved too early, then the new incoming mail to old tenant will not get migrated.

2. If mailbox data is moved after cutover, as long as mailbox data is not move together with new tenant mailbox creation, that will be OK, since usually that's acceptable for a user to receive and send email, and old data re-appear even after 1/2 day.

3. So, when you cutover the mail path (from old tenant to new tenant), the new tenant should already have the mailbox present (but not necessary all old mailbox data)

4. If at the time the mailbox is cutover, if the domain (new tenant via DNS name) is not contactable, foreign mail system will retry until 2 days, NDR is return to sender, BUT

5. If the new DNS domain is ready on new tenant, just the user email account has not been created, the new tenant mail daemon will reply to sender server "user not found" and immediately reject the email.  In this case, the send will get immediate NDR, this is no good.

In summary, you should think of the following steps:

i. Uninstall existing Azure AD Connect tool.
ii. Configure new Azure AD Connect by downloading it from new tenant
iii. Make sure the on premise AD is all well sync with new tenant Azure AD
iv. Pre-create all Exchange online mailbox on new tenant
v. change all email address from old tenant from @your_dns_domain to @old_tenant.onmicrosoft.com to release all dependency
vi. delete the DNS domain from old tenant
vii. configure the DNS domain in new tenant, you might need to modify on external DNS records and wait for TTL expire
vii. change the email address of all pre-created mailbox to @your_dns_domain
viii. confirm all email is routing to new tenant and no mail is incoming on old tenant (that might take times, since there are many SMTP edge server of Office 365, you won't be able to tell when their setting are converged)
ix. migrate JUST mailbox data, from old tenant data store to new tenant data store

Cheers.
0
 
RimFire007Author Commented:
Thanks Lawrence

I need to study your latest email for awhile.

Just a quick note. Usually when I do a BitTitan mailbox migration I'm able to migrate mails after the new system is up and running and mailflow goes through that. I can still migrate mails that happens to go to the old system since in BitTitan portal I refer to the (onmicrosoft.com) domains which are unique. Not really bothered to check what actually happens in the end users mailbox and is this really true. I suppose it is.
0
 
RimFire007Author Commented:
Thanks

Was able to do the job via these hints. Should have chosen in the BitTitan both the source and the Target username refereing the onmicrosoft.com domains.
0

Join & Write a Comment

Featured Post

The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

  • 7
  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now