Staged Exchange Migration with ADFS and DirSync

Some organizations implement ADFS and DirSync in order to take advantage of the Single Sign-On capabilities. However, not all of them opt for a hybrid deployment and perform a Staged Exchange Migration instead to move mailboxes from the on-premises environment to Office 365.

 

In order to perform such migration, one of the steps involved is the creation of a CSV for the Migration batch. This CSV needs to have three columns: EmailAddress, Password and ForceChangePassword.

 

The problem here is if the ForceChangePassword field is set to True. This will cause the migration to fail because Office 365 cannot modify that attribute for an Identity Federated user (remember we are using ADFS and DirSync) so you would get an error.

 

To overcome this, simply update the CSV file and set the ForceChangePassword field to False. This should allow for the migration to succeed.

Office 365 Identity Federation Debug Tool

The Microsoft Remote Connectivity Analyzer tool has been updated and it now includes testing for Office 365 federated identity provider. This can be used with an Office 365 tenant configured for federation with either ADFS or another WS-* based Security Token Service. It helps debug possible issues with the federated identity provider through simple tests.

 

The tool is available for download here.

 

Once downloaded and installed, click on “I can’t setup federation with Office 365, Azure, or other services that use Azure Active Directory (Beta)”:

 

 Then enter your Office 365 credentials and begin the login test of your federation configuration:

 

 Tests are done from the PC that you download the testing tool to. It will attempt to log in to Office 365 using the federation configuration. The testing will proceed and then show results which should help debug any possible federation issues.

Microsoft DirSync Force Directory Synchronization

Recently I have been working on Office 365 and AD FS and at this stage I keep creating, changing and deleting accounts. By default the Microsoft Online Services Directory Synchronization Tool synchronizes changes made to the Active Directory user accounts to those in the Microsoft Online Services directory every 3h, which is a long time for me to wait...

If you are testing something or want to immediately disable someone’s account (maybe because their contract has terminated), you will want these changes synchronized as soon as possible (like me).

To achieve this, you have to manually force a directory synchronization by running the Microsoft Online Services Directory Synchronization Configuration Wizard again or by using the Directory Synchronization PowerShell cmdlet.

To force directory synchronization using the Configuration Wizard:

1. On the computer that is running the Microsoft Online Services Directory Synchronization tool, click Start -> All Programs -> Microsoft Directory Synchronization and then click Directory Sync Configuration;
2. Follow the instructions in the wizard and provide the requested credentials;
3. On the Finished page of the wizard, select Start directory synchronization now, and then click Finish.

To force directory synchronization using PowerShell:

1. On the computer that is running the Directory Synchronization tool, navigate to the directory synchronization installation folder, %programfiles%\Microsoft Online Directory Sync (by default), and then run DirSyncConfigShell.psc1 to open a PowerShell window;
2. In the PowerShell window type Start-OnlineCoexistenceSync and then press Enter.

To double check that the synchronization worked, login to your Office 365 portal and click in Users. In here you will see when the last synchronization happened:

Another option is to change how often the directory synchronization occurs. To change this:

1. On the computer that is running the Directory Synchronization tool, navigate to the directory synchronization installation folder, %programfiles%\Microsoft Online Directory Sync (by default);
2. Open the Microsoft.Online.DirSync.Scheduler.exe.Config file for editing;
3. Update the value of the SyncTimeInterval key with the interval that you prefer (the value is expressed in hours, minutes and seconds).

Hope this helps!

Office 365 Diagnostic and Logging with ADFS

With the recent release of Office 365, the Microsoft Office Services Diagnostics and Logging (MOSDAL) tool has also been updated to provide ADFS authentication diagnostic information.

So if you are experiencing issues with Office 365 / ADFS, give it a go!