In this example I have local Active Directory with AAD Connect installed one of the Azure Region, which sync users and password hash to Office 365. I have now decided to migrate the authentication from local Active Directory to Office 365 and decommission on-premises Active Directory.
In order to transition from on-premises “Synced Identity” to “In Cloud Identity”, we will need to complete the following process.
Sign into the AAD Connect Server and Sync the Delta
The following command performs a sync of all AD Objects before attempting to convert into Cloud Only.
Turn off AAD Connect Sync
The following command turns off Azure Active Directory Connector while we perform all the following tasks. In this post I have outlined all steps which can be taken to convert AD Users account into Cloud Only.
Set-MsolDirSyncEnabled -EnableDirSync $false
Convert Single User to Cloud Only
The following command converts a single user into a Cloud Only account
Get-MsolUser -UserPrincipalName firstname.lastname@example.org | Set-MsolUser -ImmutableId $null
Remove Immutable ID of all users
The following command removes the Immutable ID for all users
Get-MsolUser | Set-MsolUser -ImmutableId $null
Remove Immutable ID for Bulk users
The following scripts allows you to modify users at bulk
$Filepath = $env:userprofile\desktop\file.csv
$csv = Import-Csv -Path $filepath
Foreach($user in $csv)
Set-MsolUser -UserPrincipalName $user.UserPrincipalName -ImmutableID $immutableID
Turn on Azure Active Directory Connect Sync
Once you have completed all the required conversions of AD accounts to Cloud. Head back to your local Active Directory, move user(s) to an OU that isn’t synchronized using AADC.
This helps you as an IT Pro understand who has been converted at a quick glance now not worry about using PowerShell to discovery who is or isn’t.
The following command turns on Azure Active Directory Connector now that we have converted the
Set-MsolDirSyncEnabled -EnableDirSync $true
Enable Force Sync if the Sync didn’t work
Start-ADSyncSyncCycle -PolicyType Initial
If you are using an ADFS Server there is an additional step providing you have
1 Convert-MsolDomainToStandard -DomainName blogabout.cloud -WhatIf<br>Convert-MsolDomainToStandard -DomainName
1 blogabout.cloud -Confirm
All that is left now is to log in as one of the converted users to prove Single Sign-On is working and logon as a Global Admin into Office 365 to check the sync status of the users has a pretty cloud for “In-Cloud”
The Author – Blogabout.Cloud