SOLVED

Azure AD connect group soft match

Contributor

Hi all, we have migrated to a new onprem AD forest recently, but kept the same O365 tenant.

Soft matching of user accounts between new AD and O365 went just fine. 

But we are facing some issues when matching cloud distribution lists and email enabled security groups with onprem objects.

Insted of matching the groups, O365 just creates a new group with company.onmicrosoft.com smtp address. Any ideas ?

Azure AD Connect Health shows an error saying that there are duplicate attributes - SMTP proxyaddress.. but SMTP has to be the same on onprem and Cloud object in order for soft matching to work...

I have done this kind of group soft matching a few times before and it worked fine, but not in this case...

R-

3 Replies
Would love to know if you managed to solve this?
Tracking the same issue here https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_dirservices-mso_o365b/aad-...
best response confirmed by RNalivaika (Contributor)
Solution

@catmur-fed I solved the issue by resorting to hard-match instead.

I had also tried solving the issue with MS Support, but they were basically saying the same as you report in the thread, so that lead nowhere.

The solution was to change source anchor to mS-DS-ConsistencyGuid on AzureAD Connect setup, populate matching immutableID on onprem groups and then run sync.

you can take a look at this article for reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-design-concepts#changing...

there was another article regarding group hard-maching but i cannot find it, i will maybe try later.

Cheers

Thanks @RNalivaika  - I might give that a try later today.