Forum Discussion
Convert On-Prem AD Users from Office 365/Azure AD to In-Cloud accounts
This process of changing the ImmutableId in the cloud directly is not supported and it was available due to a bug in Azure AD. As of today, this has been fixed and so it's no longer possible to update the ImmutableId or change the source or authority to "Cloud-only", unless you disable DirSync on the whole Tenant. There's a new feature in AAD Connect called "Update SourceAnchor" that will change AAD Connect's source anchor configuration from ObjectGUID to ms-Ds-Consistency-GUID attribute which will allow you to manage the Immutable's value in local AD, instead of having to change it in the cloud with Set-MsolUser.
Hello,
Is there any documentation of this correction ?
Maybe it was a bug by Microsoft BUT many of us used this 'bug' from years !
There's now a release note regarding this change at:
What's new in Azure Active Directory?
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/whats-new#novemberdecember-2018
This helps explain the background reasons for Microsoft having to fix this bug. The main thing to keep in mind is that, unfortunately this bug was giving the wrong impression that accounts synchronized from AD were 'converted' to cloud-only accounts, when in reality this 'trick' was just flipping one simple DirSyncEnabled flag and keeping all the main synchronized properties of the object. The Office 365 portal showed the accounts as "Cloud-only" because it was only looking at the DirSyncEnabled flag. So the 'trick' was not really converting anything at all in first place.
- this is a huge change I was doing it for many years also !
Thanks,
Yousef
