Blog Layout

How to Hard Match Office 365 Identities to On-Premise Users

Akins IT • January 8, 2020

When migrating from on-premise exchange to Office 365, IT administrators can experience failure when attempting to soft match identities. Soft matching (also known as "SMTP matching") can fail for many reasons, the common one being because Office 365 detects that the email is already associated with another object. In the case of a soft match failure, a hard match must be performed. The solution to this is to stamp the online identities immutable ID with the GUID from the on-premise user, which can be done on-premise on the Active Directory server.

This is a simple PowerShell solution to hard match an on-premise GUID to an immutable ID for an online user. This ensures that all on-premise identities are correctly matched and linked to the Office 365 identities, which allows for full Office 365 write-back functionality in an organization's environment.

Provided below is the step-by-step guide on how to carry out this solution:

Remove on-premise Identity from syncing with O365
Remove on-premise Identity from O365 and Remove from Recycle bin
Launch Powershell and run the following Commands
Set-ExecutionPolicy RemoteSigned
$credential = Get-Credential
Input admin credentials for Office 365 and run the following command
Import-Module MsOnline
Connect-MsolService -Credential $credential
Run “$ADGuidUser = Get-ADUser -Filter * | Select Name,ObjectGUID | Sort-Object Name | Out-GridView”
Select the on-premise user from the Grid
Run “$UserimmutableID = [System.Convert]::ToBase64String($ADGuidUser.ObjectGUID.tobytearray())” in powershell to convert GUID to the immutable ID format
Run $OnlineUser = Get-MsolUser | Select UserPrincipalName,DisplayName,ProxyAddresses,ImmutableID | Sort-Object DisplayName | Out-GridView -Title "Select The Office 365 Online User To HardLink The AD User To" -PassThru”
Select the Online identity to match on-premise identity
Run “Set-MSOLuser -UserPrincipalName $OnlineUser.UserPrincipalName -ImmutableID $UserimmutableID”
Set the Online identity with the new immutable ID
Run “Set-MSOLuser -UserPrincipalName $OnlineUser.UserPrincipalName -ImmutableID $UserimmutableID”
Check the immutable id matches
Run the following two lines and confirm IDs Match
“Write-Host "AD Immutable ID Used" $UserimmutableID”
“Write-Host "Office365 UserLinked" $Office365UserQuery.ImmutableId”