O365 User Import - some users showing incloud.

Hello,
I am having a problem that I have been working on the last few days trying to work out with my O365 user import that I just cannot seem to make any headway on. To make this short I set up AD Connect to synchronize one OU full of users into O365. I only did one OU as I wanted to do a test right now to make sure the import was successful. All the users showed up under Active Users in the admin panel. All the users imported as they should but two for some reason two users are showing in cloud vs. synced with active directory. Now these two users did have an account created before we did the user sync import and they are fellow admins like myself. I have tried deleting the accounts, even from the recycle bin. Tried remapping the immutable ids and they are correct. I have tried looking at the synchronization service manager and to be honest, I do not see many options to adjust. Can anyone offer any guidance for me to look next? I did run the idfix tool from MS and there are no duplicates or error found. I did also look at the AD attributes to make sure there were not invalid characters or if the fields had any invalid values.

I’m stumped…
LVL 5
BAYCCSMSPAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Vasil Michev (MVP)Commented:
Did you check for any errors in the MIIS client or in the notification email received after each sync? Can you actually see those users in the Metaverse (MIIS client -> Metaverse tab -> Search)? Basically, what's detailed here: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-troubleshoot-object-not-syncing
BAYCCSMSPAuthor Commented:
Hello Vasil thank you for your response. That is the thing, I am not getting any errors that I can see. I haven't tried using the MIIS client to manually sync. I will do that now. AD Connect runs fine and the DirSync tile in the O365 admin doesn't show any errors. I am curious about the email you are talking about. I don't get an email everything a sync runs? Is this just a MIIS Client thing?
BAYCCSMSPAuthor Commented:
Ah so I just checked and the MIIS Client is actually the Synchronization Service Manager. When I kick off a full sync it shows as success and and the user is listed in the Metaverse tab under search. Just never shows up as a user in O365.
Rowby Goren Makes an Impact on Screen and Online

Learn about longtime user Rowby Goren and his great contributions to the site. We explore his method for posing questions that are likely to yield a solution, and take a look at how his career transformed from a Hollywood writer to a website entrepreneur.

Vasil Michev (MVP)Commented:
And do you see two connector entries for the object, as shown in the article I linked above?
BAYCCSMSPAuthor Commented:
You are right, only one connector entry!

I am looking into the steps to remedy this now.
Vasil Michev (MVP)Commented:
That usually means the objects are being filtered by one of the default rules. But hard to guess without being able to see anything, so I will leave it to you :)
BAYCCSMSPAuthor Commented:
I am not sure if it is a filter b/c the only thing I have in place is defining which OU to sync from. Those users are in that filter. I am reading all the articles now but it is going to take a little bit to look at all this.
BAYCCSMSPAuthor Commented:
I am reading this MS article under the filtering section. Where are these filtering systems. I don't see them anywhere in AD Connect or in the Sync Manager?
scope.png
Vasil Michev (MVP)Commented:
Those are the sync rules, you can check them via the Sync Rule Editor ("C:\Program Files\Microsoft Azure AD Sync\UIShell\SyncRulesEditor.exe") or via PowerShell. But unless you have made some changes to the default configuration, they should not be the cause. Can you share a screenshot with the MV attributes for one of the affected objects?
BAYCCSMSPAuthor Commented:
Of course, I just blanked out some personal info.
Capture.JPG
Vasil Michev (MVP)Commented:
There's nothing wrong with those, but that's not the full list. Check in particular the CloudFiltered one, as this is the attribute used to filer out some of the "default" objects. Here's the actual criteria used:

IIF(IsPresent([isCriticalSystemObject]) || IsPresent([sAMAccountName]) = False || [sAMAccountName] = "SUPPORT_388945a0" || Left([mailNickname], 14) = "SystemMailbox{" || Left([sAMAccountName], 4) = "AAD_" || (Left([mailNickname], 4) = "CAS_" && (InStr([mailNickname], "}") > 0)) || (Left([sAMAccountName], 4) = "CAS_" && (InStr([sAMAccountName], "}") > 0)) || Left([sAMAccountName], 5) = "MSOL_" || CBool(IIF(IsPresent([msExchRecipientTypeDetails]),BitAnd([msExchRecipientTypeDetails],&H21C07000) > 0,NULL)) || CBool(InStr(DNComponent(CRef([dn]),1),"\\0ACNF:")>0), True, NULL)

Open in new window

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
BAYCCSMSPAuthor Commented:
Turned out to be the msExchRecipientTypeDetails was set to a value of 2 for those accounts. I switched them to one and bingo, they popped right in a few minutes later.

Thank you for your help and time!
BAYCCSMSPAuthor Commented:
After two days of troubleshooting, turned out to be a AD Attribute that was set for a linked mailbox.
msExchRecipientTpeDetailswas set to 2 and needs to be set to 1
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Office 365

From novice to tech pro — start learning today.