Forum Discussion

office3651740's avatar
office3651740
Copper Contributor
Jan 03, 2019
Solved

Office365 Migration

Hello,

 

On Friday December 28th we started our Office365 tenant to tenant migration. On the old tenant we disabled dirsyn (Azure AD Connect) and then uninstalled the tool altogether from our on-prem domain controller.

 

On Saturday December 29th we installed the Azure AD connect again and connected it to the new tenant once we have the domain verified to do SMTP matching to the on-prem AD accounts.

 

Fast forward to this week and we have most users online, however we have a small amount that continually get password prompts in Outlook. On the problem users we've reinstalled Office, Wiped out Outlook profiles, etc. We've also noticed on these machines (we are 100% Windows 10 Pro) that under the Windows 10 Settings > System> Shared Experiences it's showing Fix me on some of the workstations but not all of the problem ones show this. Under Windows 10 Settings > Accounts >Email & App Accounts/Access Work or School sometimes shows the old tenant name.

 

It's almost like some of these accounts are connecting to the new tenant properly, or there something lingering in either our AD our on these workstations that is pointing to the old tenant still. We've also now tried importing the ADMX templates for Office 2016 and disable previous Autodiscover settings in GPO.

7 Replies

  • The affected PCs are likely retaining Windows Web Account Manager and Workplace Join credentials from the source tenant. Reinstalling Office or changing Autodiscover settings usually won’t fix that.

    Run dsregcmd /status first. Then remove the old account from Settings > Accounts > Access work or school and from Email & accounts. Restart Windows, then connect the new tenant account.

    Also remove any old Office-related entries from Control Panel > Credential Manager > Windows Credentials.

    You can then run Microsoft’s signoutofwamaccounts.ps1 script as administrator to clear cached Office sign-in tokens before signing in again.

    Be careful with dsregcmd /leave. Don’t use it indiscriminately on Microsoft Entra joined or hybrid joined devices because it changes the device registration state rather than just clearing the old Office identity.

  • Hi,

    I have seen very similar things to this when doing tenant mergers in a past role.

    Are you using exactly the same domain in the new tenant? It would mean the credentials to log into the new tenant are exactly the same as the old (considering you are using AADConnect). The point is this may cause issues with the credential manager.

    Have you considered, with an impacted user, flushing their credential manager on their Windows machine and then resetting their AD password so their login credentials to the new 365 tenant are different from previously? Would be good to hear how this goes.

    Other than this, you disabled GPO but have you checked the impacted users hosts file (anything there?).

    Best, Chris
    • office3651740's avatar
      office3651740
      Copper Contributor
      Hello,

      Yes same domain name from the old tenant to the new. We had to change the usernames on the old tenant in order to remove the domain name to move to the new tenant.

      We have tried wiping out credential manager as well, however we will try it again. We've come across various forum threads regarding registry keys to disable the Windows 10 WAM (Web Account Manager)

      We might have to try this as well. We're an organization of 120 and roughly 25 users having this ongoing issue. Very frustrating.