After User Sync to Azure AD, migrate to another OnPremise AD

ShellBlazer

Brass Contributor

Jul 16, 2020

Jeffrey_Goins

This is a way you could go about it:

1. Disable sync: https://docs.microsoft.com/en-us/office365/enterprise/turn-off-directory-synchronization

2. Wait for your objects to get the status of cloud managed instead of synced

3. remove the imutableID of your cloud objects.

For started:

Get-MsolUser -All | Set-MsolUser -ImmutableId $null

4. Set up ADconnect in the new domains

5. Either hard match or soft match the on prem accounts:

Softmatch: based on attributes: UPN, Default smtp, ...

Hardmatch: generate and set immutableID

Generating immutableID as such:

$User = Get-ADuser $UserSamAccount -Properties * -server $DC

$ImmutableID = [system.convert]::ToBase64String(([GUID]($User.ObjectGUID)).tobytearray())

Make sure your users in the new domains have the required attributes before you sync. (Correct UPN, ProxyAddresses, User attributes, ...) Or you will remove the attributes from your cloud objects by synching the incomplete users. You can export the old domain users and the cloud objects with PowerShell just to be on the safe side.

Before you do any operations like this that you are not familiar with, always test run this in a demo environment!!

Forum Discussion

After User Sync to Azure AD, migrate to another OnPremise AD

Resources