Hi, for the past month I've had a problem with handling leavers' accounts in O365.
We use Azure Active Directory Connect to handle the syncing between AD and O365.
The way the process used to work is this:
- To begin with, the leaver's account appears in O365 Admin Center, with a Sync Type of 'Synced with Active Directory'.
- In 0365 Exchange Admin Center, Convert the leaver's mailbox to a shared mailbox.
- In 0365 Admin Center, remove their O365 licences
- In ADUC, disable the leaver's user account and move the user to an OU which is not synced with O365.
- In Azure Active Directory Connect, perform a delta sync cycle.
- After the sync, the user will have moved from 'Active Users' to 'Deleted Users' in 0365 Admin Center.
- Select the user and click 'Restore'. Set a new password for the user.
- The user will now be restored to 'Active Users' in O365 Admin Center, with a Sync Type of 'In Cloud'.
- In 0365 Exchange Admin Center, edit the settings of the leaver's mailbox and tick the 'Hide from Address Book' tickbox.
As I say, that's how it USED to work. But beginning about a month ago, the process isn't working properly.
When I restore the user from 'Deleted Users' in 0365 Admin Center, the user is restored but the Sync Type is still saying 'Synced with Active Directory' - even though the AD user account has been moved to an OU which is not synced with O365.
As a result, I can't edit the settings of the leaver's mailbox and tick the 'Hide from Address Book' tickbox - I get a message telling me the 'the object is being synchronized from your on-premises organization'.
Just to make things even more annoying, I tried re-enabling the leaver's AD user account and moving it back into the synced OU. Then I edited the MSExchHideFromAddressLists
attribute, setting it to TRUE rather than 'not set'. Then I did another sync... but the change to the attribute is not appearing in o365 - the mailbox's 'Hide from Address Book' tickbox is STILL not ticked.
I've just updated the version of Azure Active Directory Connect on the Domain Controller to version 220.127.116.11, in case the problem was due to a bug in version 18.104.22.168 which I installed a couple of months ago. But it hasn't made any difference - the leaver accounts are still showing as 'Synced with Active Directory'.
The O365 accounts of users who left more than a month or two ago are fine - they're still 'In Cloud'. The problem is only happening with users who left in the last month or two.
Has anyone else experienced this sudden change in behaviour? Do you know how to fix it?
Any advice most welcome!
Yes, this is new behavior, and no...according to Microsoft...this new behavior is *NOT* a bug. It is the result of them *fixing* a bug with immutable IDs.
The only supported way to convert an account from AD synced to "In Cloud" now is to disable sync, wait for that to complete and report disabled. (All accounts will now be "in cloud." Restore the moved/deleted account in O365. Then re-enable sync, which will do new soft matching and since the account on-prem is no longer in the OU (or was deleted or whatever), it won't match and will remain "in cloud."
There are a few Microsoft support forums discussing this change and a uservoice feature request to allow an easier conversion process, but that's the current situation.