Sync an Existing Office365 Tenant into a New Active Directory Domain

[RhysLwk]

Hi,

          My company is existing Office365 (E3) tenant and i planning to run Azure AD Hybrid join and implement a on-premises new Active directory  and sync my Office365 (E3) tenant Azure AD details into it.

           In this case, do i need to purchase CALs for the on-premise AD services? if no, can we use the GPO features?

[#2]

So you want to sync your Azure AD users to AD?
Known that there is no sync from AAD to AD. IF you want to populate your users to AD, you will have to write a custom Powershell script that creates users and matches their UPN's.

You need a call if a user will interact with the on-prem AD.

What is your reasoning for needing on on-prem AD? If you are currently in the cloud, I wouldn't look into migrating back

[#3]

Thank you @Thijs Lecomte 

That was because our client is requested no internet access for our staffs who will handling the project. So we planning isolate the network and implement a on-Prem AD to control/monitor the staffs in office. 

I am quite confuse about the CAL Suite Bridge licenses (User CALs) or we just need to  purchase server core CALs for AD services. 

[#4]

I don't have any info about CALs unfortunaly. You should look into a different forum for that.

Could you try limiting the workstations your staff will use so that they can only do what client wants them to do?

Setting up a domain for a single project seems overkill to me