Forum Discussion

Gregg Hamby's avatar
Gregg Hamby
Copper Contributor
Oct 31, 2017

AD Connect + two forests = frustration?

Greetings all. I’m working with a client that had an existing forest synced to O365 without issue. The client has a compliance mandate that required creating a separate forest and creating certain ex...
Azure Active Directory (AAD)
Peter Stilgoe's avatar
Peter Stilgoe
Iron Contributor
Nov 01, 2017

If I've understood correctly I very much doubt this is supported, from a IDM perspective user v account is a 1:1 relationship.

Gregg Hamby's avatar
Gregg Hamby
Copper Contributor
Nov 01, 2017

Well, I understand what you mean and indeed there is only one O365/Azure AD account in use but if there is no supported way to handle multiple forests with non-unique users why then does the AD Connect wizard offer a step of selecting an attribute to identify users in multiple places? Why then are there precedence rules that dictate which order conflicting attributes are to be resolved?

This is part of our problem. MS support has already stated that we cannot do this without changing the UPNs of the non-unique users in O365. We do not want to do this and all of the relevant documentation and support/blog posts I'm reading suggest that this scenario should work.

If it is in fact not supported I really wish MS would update their guidance to clearly and specifically spell this out.

If we cannot get past this our solution will be to filter off the users in the original domain altogether and then manually map the users in the new domain to the existing O365 users.

Thanks for your reply.