Forum Discussion
Problems setting up Azure AD Connect
You need to look at the Export flows. In general, the question you need to answer here is whether you see a new/duplicate account provisioned for the same user in O365? And, whether there are "quarantined" objects due to the duplicate attribute resiliency feature: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-syncservice-duplicate-attribute-resiliency
For general info, objects are being matched between AD and AAD on objectGUID first, and if that fails on the PrimarySMTPAddress (so-called hard-match and soft-match mechanisms). The later will only work if the ImmutableID is empty. Neither one will work if there are errors/quarantined object due to duplicate attributes. Matching UPNs will not "link" the two objects, but you can force the matching process using the articles I linked to above.
One other thing, you should not mess with the objectIdentifier/sourceAnchor, unless you have some specific configurations in place. It's not clear to me why you have chosen to use the mail attribute and not leave the default.
Hey Martin,
That sounds correct and fine. Can you take a look at the logs?
This article shows exactly where you need to go - https://docs.microsoft.com/en-us/azure/active-directory/hybrid/tshoot-connect-object-not-syncing
Find the connector you have setup, and the update that is syncing your objects (a new full one should show two), and look for any errors there. If you look at the first SS on that doc, they have selected a connector, and then a task (in this case updates, but you may be adds on a full sync), then the errors should show in the bottom right.
That is your next step to figure out what is going wrong.
If you want, you can come back with screenshots or the error and we would be happy to help.
Adam
Hey!
I ran a Start-AdSyncSyncCycle -PolicyType Initial
Checked the logs, however, i dont see any errors.
Only thing i see is "Connectors with flow updates"
Check the print.
I went through all the logs.
No errors from what i could see.
You need to look at the Export flows. In general, the question you need to answer here is whether you see a new/duplicate account provisioned for the same user in O365? And, whether there are "quarantined" objects due to the duplicate attribute resiliency feature: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-syncservice-duplicate-attribute-resiliency
For general info, objects are being matched between AD and AAD on objectGUID first, and if that fails on the PrimarySMTPAddress (so-called hard-match and soft-match mechanisms). The later will only work if the ImmutableID is empty. Neither one will work if there are errors/quarantined object due to duplicate attributes. Matching UPNs will not "link" the two objects, but you can force the matching process using the articles I linked to above.
One other thing, you should not mess with the objectIdentifier/sourceAnchor, unless you have some specific configurations in place. It's not clear to me why you have chosen to use the mail attribute and not leave the default.
Hello!
Thanks for all the replys.Do you think it would be easier for me to just reinstall Azure AD Connect, but just use express settings?
If i understood this correct, it goes for ImmutableID first, if ImmutableID doesnt match it just stops?
But if immutableID is empty- it checks for a soft-match?
The OU im syncing has 3 accounts.
Account A - This account actually got synced to Office365
Account B - Does not get synced to O365
Account C - Does not get synced to O365
All 3 accounts has In-Cloud accounts in O365
- I’d redo it with express settings which works fine in most scenarios! You can always configure additional settings after!
