Azure AD Connect: Unable to update this object in Azure Active Directory, exceeds allowed length

[Admin M vdS]

I am running a Server 2016 as DC/AD

I have my Office 365 Enterprise E1 licenses assigned to my corporate users, which includes Exchange Online (E1)

My corporate users are being synched from my local AD to Azure AD using the latest version of Azure AD Connect.

I want my users to be able to use the AAD based addressbook from OWA Online and from Outlook 2016, to obtain the public UserCertificate information in order to allow for secure email encryption ie S/MIME.

My AD user accounts all have the attribute UserCertificate properly populated with a single certificate.

Other Attributes such as UserSMIMECertificate and AltSecurityIdentities are NOT populated as this isnt a requirement according to online Microsoft literature. 

My Office 365 has been populated with the proper SST file to trust any used issuing CA parties and their Root certificate, and when receiving a signed email from a trusted issuing CA these signatures are trusted in both Outlook 2016 and OWA Online.

My users all have the Microsoft ActiveX SMIME Control component for Internet Explorer installed though this is not a requirement for the problem I'm running into.

So the problem:

When my AD syncs to AAD using Azure AD Connect, I receive the following error:

Unable to update this object in Azure Active Directory, because the attribute [extension_405d00f7eed04a019ec1f0820568899c_userCertificate], in the local Directory exceeds the maximum allowed length. If you want to update, reduce the length in the local directory services, and then try again.

Reading into this issue, the error is normally caused because UserCertificate contains more than 15 certificate entries, or another field might contain more than 15 entries. However since I only have 1 certificate in my AD and other attributes are empty, this isnt the cause.

I called Microsoft Support and they told me: the solution is easy: do not sync your UserCertificate attributes , which obviously negates the entire reason why I want it synced.

I've setup a virgin environment with a new AD and another AAD account, again with a single certificate in the attribute Certificate, and again the same error occurs.

So my question: How can this issue be resolved without having to populate UserSMIMECertificate (as its a proprietary Outlook format and not properly supported from standard AD tools such as Active directory Users and Computers)

Guides I followed:

https://blogs.technet.microsoft.com/exchange/2014/12/15/how-to-configure-smime-in-office-365/

https://technet.microsoft.com/en-us/library/aa996408(v=exchg.65).aspx (yes old from 2006 but still seems valid to explain the difference between the 2 attributes)

[#2]

Hello,

Please go to the Azure AD Connect Site:

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-larg...

Azure AD Connect sync: Handling LargeObject errors caused by userCertificate attribute

Please confirm, that all described steps are done and when it’s possible, write some results back to us.

Thanks and “Good Luck”

Feel free to contact me if you any questions.

Regards

Michael

[#3]

Hi Michael

Many thanks. We've done these steps and it didnt result in any solution regretfully

Microsoft also got back to me on my ticket ref this mentioned issue, and they wrote:

Hi Michael,

This is in reference to your service request number 1XXXXXX8. We reproduced the issue in our test environment and were getting a similar error. We have engaged our backend team to check if this behavior can be changed or is there a work around for this specific issue. I will keep you posted on the status of the same.

Thank you for your support and patience.

Regards,
Abhilav 

[#4]

@Admin M vdS 

Hi have you ever mitigated this issue? I see the identical issue with just one cert in two tenants.

Kind Regards

Anthony