How to Sync On-Prem AD With Existing Azure AD Users

Do you have existing Azure AD Users using Office 365 and you need to sync them with on-premises Active Directory?

In this guide, I’ll walk through how to sync on-premises AD Users with existing Azure AD Users.

In this example, I have 5 existing Azure AD User accounts.

Azure AD Accounts (Cloud Only)

I’ve created the same users in my on-premises AD and I want to sync them with the existing Azure accounts.

On-Prem AD Accounts that I need to sync with Azure Accounts

Soft-match vs Hard-match

There are two options to match on-prem AD users with existing Azure AD Users.

1. Soft Match = A match on userPrincipalName E-mail and proxyAddress.
   • This option is easier to implement if you have a lot of users that need to sync with Azure.
2. Hard match = A match on the immutable ID.
   • This requires several steps and there is no easy way to implement this to multiple users.

Next, I’ll walk through both examples.

Sync on-premises users with Azure using Soft Match

You will need to modify the following three attributes for each on-prem user account.

1. UserPrincipalName (logon name)
2. Email
3. ProxyAddresses

Tip: The AD Pro Toolkit allows you to easily bulk modify/update user attributes. See the example at the end of this article for more details.

Step 1. Set UserPrincipalName

The on-prem AD account’s UserPrinicpalName needs to match the Azure account’s Username.

For example the Azure user Adam Anderson username is adam.anderson@activedirectorypro.com.

My on-prem AD account must match this.

Click the account tab and check the user logon name.

It matches.

Step 2. Set E-mail

The on-prem user account email must match the Azure account. Click on the General tab and check the E-mail field.

Step 3. Set ProxyAddresses

The on-prem account must have the primary proxyaddress set.

Click on the attribute editor tab then click on proxyAddresses. Add the primary SMTP address using capital SMTP.

When you have those 3 account settings configured move to step 4.

Step 4. Force Azure AD Sync

Force an Azure AD sync with the below command.

Start-ADSyncSyncCycle -PolicyType Delta

Open the Azure Synchronization Service Manager and verify it added or modified the user.

You can click on adds and then the distinguished name to view more properties.

Step 5. Check Azure Object Sync Status

Hopefully, the Azure account will now say synced with on-premises.

Wow, it actually worked. My Adam Anderson account is now showing synced from on-premises.

Sometimes it works and sometimes it doesn’t. I’ve followed these exact steps before with no luck. I even contacted Microsoft support and they said sometimes it does not work and the only solution is to use hard match.

Sync on-premises users with Azure using Hard Match

If a soft match does not work then you will need to use a hard match.

A hard match sets the Azure immutableID to the same value as the on-prem objectGUID.

Even though this method will hard code the immutableID you should still make sure the local AD is using the same userPrincipalName and email address as the cloud account.

Step 1: Get Local AD Users ObjectGUID

Replace USERNAME with the users sAMAccountName

$OnPremUser = Get-ADUser -Identity USERNAME -Properties objectGUID

Step 2. Convert objectGUID to ImmutableId (Base64)

$ImmutableId = [System.Convert]::ToBase64String($OnPremUser.objectGUID.ToByteArray())
Write-Output "ImmutableId: $ImmutableId"

Step 3. Connect to Microsoft Graph

Connect-MgGraph -Scopes "User.ReadWrite.All"

Step 4. Set New immutableID for Azure account

Replace UPN with the users UPN.

Update-MgUser -UserId UPN -OnPremisesImmutableId $ImmutableId

Step 4. Verify ImmutableID value

This command will verify the cloud users ImmutableID has been updated.

get-mguser -userid UPN -property OnPremisesImmutableId | select-object OnPremisesImmutableId

You can see in the screenshot above the cloud account’s ImmutableID has been updated.

At this point, we have linked the local AD account and Azure AD account together using the immutableID (local accounts objectGuid to Azure AD account immutableID).

Step 5. Force Entra Connect Sync

Start-ADSyncSyncCycle -PolicyType Delta

Wait about 5 minutes and then check the Azure account if it is now synced with on-prem account.

Success! The on-prem account is now synced up with the Azure account.

As you can see the hard match takes multiple manual steps, this will be a pain to do for many accounts.

Bulk Modify UserPrincipalName, Email and ProxyAddresses

You can easily bulk modify on-prem AD accounts using the AD Pro Toolkit.

For example, I have 47 users in my Marketing OU and they are missing the email address and the proxyAddresses need to match the Azure account.

Using the AD Pro Toolkit I can easily bulk update these attributes.

1. Generate or create a CSV file
2. Click on Update Users tool
3. Select your csv file and click run.

Bulk update email and proxyAddresses attributes

Now I can use the export users tool to quickly view the userPrincipalName, email, and proxyAddresses attributes for all my users,

View mail, proxyaddresses, and userprincipalName for all users

To learn more about updating user attributes see the resources below.

• How to Bulk Modify Active Directory User Attributes
• How to Bulk Update ProxyAddresses Attribute

Conclusion

In this guide, I showed you how to sync on-premises AD Users with existing Azure AD Users. I prefer to use a soft match but unfortunately, it doesn’t always work and you have to do a hard match. No matter which option you use to sync the accounts it is important that the email, proxyaddresses, and userprinciapName match between on-prem AD and Azure AD.