Nov 04 2020 06:31 AM
Nov 04 2020 06:31 AM
Over the last few weeks i've been reading a lot around Tenant-to-tenant migration, and we've been playing around with the new features and it's been pretty cool.
However, I have a question around migrating AD User Objects and standing up a new AADConnect server in a new environment but still syncing into the same Azure AD & O365 tenant.
So in summary:
Current Set up:
* On-Premise Active Directory (AD users) in Forest A
* All users are synced via AAD Connect server in Forest A
* Hybrid with Exchange 2016 in Forest B (two-way trust with Forest A)
* All mailboxes are migrated to Exchange Online
Target Set up:
Due to Business reasons (change in datacentre/supplier), we want to continue to use the existing O365 Tenant and Azure subscription, but need to migrate AD Objects (Source of Authority) and stand up a new AAD Connect server to sync the AD objects to the migrated mailboxes in the environment.
So the Target environment would look like this:
* All AD Users (source of authority) are in Forest C (We will set up a Two-Way trust with Forest A)
* The AADConnect server to sync all objects to the O365 tenant will also need to be stood up in Forest C
* The EXO mailboxes in O365 should not be impacted.
AFAIK, there is limited documentation around this online, but if anyone has any experience around this, have used any articles, or can think of any gotchas, would be good to get your views.
I've done something similar with a few previous customers so have a high-level idea but would be good to see if anyone has done this - I know it will require an AD Migration cross-forest (maybe ADMT/3rd party like Quest) and I guess the UPN's will change for the users, but more around planning (coexistence/phased vs. cutover). etc.
Feb 05 2021 03:26 PM
Feb 06 2021 02:57 PM
@saifs19802210 Hi Saifs,
Thank you so much for your response.
So instead of using ADMT, we have created brand new users in Forest C. So at the moment, they are ForestA.Local UPNs. But these are not being synced YET.
In our New AADConnect in Forest C, we have added the Forest A users into the scope to be synced. At the moment, new AADconnect server is in Staging mode.
So the plan is:
1. Add the users from Forest A OU's into Scope onto my new Forest C AADConnect in Staging Mode
2. Make the staging mode server in Forest C as Primary Server. Hopefully no change to users at this stage
3. Add a test number of users to Sync from Forest C. This should mean they are synced but not matching the cloud users YET.
4. So I need to then manually change the UPN of the Forest A users from firstname.lastname@example.org to email@example.com and then change the Forest C synced users' UPN to firstname.lastname@example.org - If that doesn't work automatically, I will need to manually hardmatch the Forest C user to the cloud user by setting the Immutable ID
That should work hopefully.
My only concern is if Azure doesn't like the same custom domain name (Externaldomain.com) coming from 2 Forests - i don't think that should be an issue?
Feb 06 2021 04:01 PM
Feb 07 2021 03:30 AM
@LIT-RS - I'm not sure the matching will work as each sync'd user account from Forest A will have an immutable ID on the Azure side.
You'll need to clear that for each user in Azure before it'll connect to another on prem sync'd account.
Feb 07 2021 05:16 PM
@steve_elliott Hi Steve,
Agreed - So plan is: Set-msoluser -UserPrincipalName email@example.com -ImmutableID "$null"
^ this will be performed on the user that is synced from Forest A. This will then make it "cloud only".
Immediately after that:
Set-msoluser -UserPrincipalName firstname.lastname@example.org -ImmutableID "%immutableID of the Forest C user's ObjectGuid converted"
^ this will then force (hard match) the cloud account to the Forest C AD user.
Is that would you meant?
Feb 07 2021 06:06 PM
@LIT-RS - Yep. You just need to clear the immutable ID for the user.
Then when you bring Forest C sync online (assuming it's going to be the same UPN) - matching will happen automatically.
If you are keeping the same UPN's the approach I've personally take would be something like :
Forest A - Disable AD Connect tenant wide using powershell - All accounts will convert to cloud only
Disconnect / Uninstall AD Connect on Forest A
Run MSOL command against all users in tenant, again using PS
Bring AD Connect online in Forest C
Sync - UPN's will match up and sync