Category Archives: Office 365

Restoring a Office 365 User Sync’d with AD

Background and Intro

Office 365 has an excellent method for providing a common identity for cloud and on-premise resources. Why would an IT administrator want to manage two separate accounts with different passwords, attributes, and group membership? Thankfully, Office 365 has DirSync (now Azure AD Connect, but DirSync sounds so much cooler, and I will forever call it that) to integrate the on-prem Active Directory with Office 365, backed by Azure AD.

Hopefully in this day and age, and now that we’ve reached the end of life for Server 2003, you have an Active Directory environment living on at least a 2008r2 functional level with AD Recycling Bin enabled. Right? Unfortunately in the not-so-perfect world we live in, there are still legacy applications and other roadblocks that keep organizations from making this jump.

Who hasn’t made the mistake of deleting a user account in a non-recycle-bin-enabled environment? And who wants to do an authoritative restore or tombstone animation? Why not just re-create the AD object? Oh, they’re sync’d with O365 and have a cloud mailbox as well…

The Process

So, how can we create a brand new user account in AD and re-map their cloud mailbox to the account? Or the AD object somehow got corrupted and we need to delete and re-create from scratch. But, again, they have an Office 365 mailbox tied to their sync’d user account. At first glance, it looks like the user and their mailbox gets thrown into oblivion, but it instead gets converted to a cloud-only account within the Deleted Users section in your Office 365 admin portal.

So go ahead and restore this object. Notice that it becomes a cloud-only object. So we’ve saved the mailbox, but we obviously want it to map back to our new AD user. Next, create the new user object in AD with the appropriate email and SMTP: value in the ProxyAddresses attribute.

Matching the ObjectGuid

So now we need to grab the AD user’s ObjectGuid. This is the value that is used to match the on-prem user account with the cloud object. Run the following to grab the ObjectGuid for the user and export it to a text file, replacing the CN, OU, and DC values where needed in the DN:

ldifde -d “CN=User1,OU=Users,DC=domain,DC=com” -f c:\User1.txt

Open PowerShell and mimic the Cloud users ImmutableID with the AD ObjectGuid


Set-MsolUser –UserPrincipalName -ImmutableId “someGuid=”

Run a DirSync and verify

Now run your DirSync – you should now see that the O365 user shows “Synced with Active Directory” and the user’s original mailbox is mapped to the new user account!

Office 365 License Changes

If you haven’t already heard, Microsoft is removing their Small Business, Small Business Premium, and Midsize Business plans, and replacing them with Business, Business Essentials, and Business Premium subscriptions. Starting October 2014, companies will be forced to subscribe to the new models at their next subscription renewal.

Many companies under 300 users have taken advantage of these plans, primarily due to the cost savings compared to the Enterprise (E1, E3, E5) subscriptions.

It is extremely important to note that there are some slight differences between the old models and the new. Particularly those who are currently using Small Business Premium or Midsize Business. Those with Small Business Premium and Midsize Business will be pushed toward Business Premium.

Two very important things to note for Business Premium:

  1. Users will lose Microsoft Access from their Office suite, assuming they are using Office 365 Pro Plus.
  2. Under Midsize Business, Microsoft allowed users to license their Office products within RDS/XenApp environments. Now, if a user attempts to license Office on a server that is a RDS session host, they will receive the following error:


So, if a company utilizes Office Pro Plus in any sort of RDS/XenApp environment, they must now subscribe to an Enterprise subscription (or purchase a volume license). Thankfully, Microsoft now allows the ability to mix and match users between Business and Enterprise, so it isn’t an all-or-nothing scenario if you only have a set of users that utilize RDS/XenApp in your environment.

The following article is helpful for making the transition:

Remember to carefully go over the changes to ensure this switch will not affect your users. It is pretty disappointing that Microsoft does not give you any notice of these changes when renewing your subscription.

Hope this helps!