O365- DirSync Configuration

DirSync Configuration

For DirSync, the default rules will continue to try and sync the on-premises UPN to Azure Active Directory and if the UPN suffix is not valid, the user will be provisioned with a “.onmicrosoft.com” suffix. The configuration change below allows you to modify DirSync such that the on-premises “mail” attribute is used in Azure Active Directory.
DirSync can be modified with the following process:

1. Open “miisclient.exe” on the DirSync server (Located in “C:\Program Files\Windows Azure Active Directory Sync\SYNCBUS\Synchronization Service\UIShell”)
2. Select the “Management Agents” tab
3. Right-click the “Active Directory Connector” and select “Properties”
4. Select “Configure Attribute Flow”
5. Expand “Object Type: user” and scroll until you find the “Data Source Attribute” of “<dn>,sAMAccountName,userPrincipalName”
6. Change the “Mapping Type” from “Advanced” to “Direct”
7. Select “mail” as the “Data source attribute” and confirm that the “Metaverse attribute” is set to “userPrincipalName”
8. Click “Edit” and then “OK” to save the changes
   
   

Considerations Post-Sync

If you have previously run a synchronization job with DirSync, you may run into one of the following scenarios:

• If the current UPN for the user is a federated domain, DirSync will not change the user’s UPN in Azure Active Directory
• If the user has a license assigned, DirSync will not change the user’s UPN in Azure Active Directory

In the above situations, you will need to update the user’s UPN in Azure Active Directory using the process documented by my peer Erik Enger: Changing UPN for Office 365 account between two SSO domains