Tuesday, January 5, 2016

Azure AD Connect does not sync some Active Directory accounts to the cloud


Recently after starting an Exchange Hybrid setup, I've notices that some users were not synced to the cloud, which means licenses cannot be assigned to them as well as cloud mailbox users will not be able to Email to them.

I opened a case with Microsoft, and finally we discovered that all the users in common were flagged as "Linked Mailbox".

Now, a Linked Mailbox are mailboxes that are usually owned by a user account from a different forest (like in a type of deployment where you have a user forest and a resource forest holding the Exchange mailboxes).

This however was not the case.

The status of a Linked mailbox is determined by the user attribute msExchRecipientTypeDetails.
A Linked mailbox will have have a value of 2 while a regular user mailbox (on premise) will have the value of 1.

You can reference the values in the following link:

O365: Exchange and AD - How msExchRecipientDisplayType and msExchangeRecipientTypeDetails Relate to Your On-Premises

Since must of my users are still on premise, I wanted to investigate how many of them had this value so using my favorite Quest Active Roles add-on and run:

$linkedMailboxes = Get-QADUser -SizeLimit 0 -IncludedProperties msExchRecipientTypeDetails | where {$_.msExchRecipientTypeDetails -eq 2} | select name,samaccountname

It is also possible to get the list by using the Active directory Powershell module:

$linkedMailboxes = Get-ADUser -Filter 'msExchRecipientTypeDetails -like "2"' -ResultSetSize $null  | select name,samaccountname

After I reviewed the results of $linkedMailboxes the next step was to modify the value from 2 to 1.

$linkedMailboxes | foreach { set-QADUser $_.samaccountname -objectAttributes @{msExchRecipientTypeDetails=@(1)} }

This can also be done using Active Directory Powershell module with the command:

$linkedMailboxes | foreach { Set-aduser $_.samaccountname -replace @{msExchRecipientTypeDetails=1} }


After performing the change run your AD connect synchronization and verify that the users from the query now appear in the cloud.
If they are not there yet, it is possible that there are additional attributes that can cause the object to fail synchronization.

Hope you will find this Helpful