3 million user on Local AD to be synchronized with Office 365 FID issue

Hello everyone,
I have a customer (University) Who has an issue with DirSync. They have 3 million users on Local AD they want to synchronize with Office 365 to enable
these users for Exchange online.
Now they have users "Students" enabled for Exchange online and management and staff are enabled on the On-premises Exchange servers.
Dirsync during the day synchronize 2 times fine without any error and again 2 times doesn't synchronize and gives error with no details. the error
is "Stopped Extension-dll exception"
More errors shown as below
Directory Synchronization:
An unknown error occurred with the Microsoft Online Services Sign-in Assistant. Contact Technical Support. SetCredential() failed. Contact Technical
Support. (0x8009000B)
I am attaching other errors as well
at Microsoft.Online.Coexistence.ProvisionHelper.GetLiveCompactToken(String userName, String userPassword)
at Microsoft.Azure.ActiveDirectory.Connector.ProvisioningServiceAdapter.Initialize()
at Microsoft.Azure.ActiveDirectory.Connector.ProvisioningServiceAdapter.Import(Byte[] syncCookie, Boolean isFullImport)
at Microsoft.Azure.ActiveDirectory.Connector.Connector.GetImportEntriesCore()
at Microsoft.Azure.ActiveDirectory.Connector.Connector.GetImportEntries(GetImportEntriesRunStep getImportEntriesRunStep)
Forefront Identity Manager 4.1.3465.0"
FIMSynchronizationService:
The management agent "Windows Azure Active Directory Connector" failed on run profile "Delta Import Delta Sync" because the server encountered errors.
FIMSynchronizationService:
The management agent "Windows Azure Active Directory Connector" step execution completed on run profile "Delta Import Delta Sync" but the watermark was not saved.
Additional Information
Discovery Errors : "0"
Synchronization Errors : "0"
Metaverse Retry Errors : "0"
Export Errors : "0"
Warnings : "0"
User Action
View the management agent run history for details.
Directory Synchronization:
The Management Agent Windows Azure Active Directory Connector failed on execution. Error returned is 'stopped-extension-dll-exception'. If the problem persists, contact Technical Support.
Customer have tried to involve Microsoft with them through a third party technical support company but microsoft was not able to apply anything since they have tried to apply some scripts but those scripts would take
3 days without finishing.
The first time the Dirsync was applied it took 1 week without finishing until now they were not able to apply a full import and export sync.
What have really got me interested is that Microsoft did not suggest to the customer to upgrade his FIM (ForeFront Identity Manager)'s old version
to the latest one.
Customer is using Full SQL deployment on a dedicated server and DirSync (FID) on a separate server too. The deployed servers are virtual and have 32
GB ram and 200 GB HDD size and 4 cores.
I have recommended to this customer that we do not touch this current deployment since Microsoft themselves couldn't do anything in regard, but what
we could do is take a virtual snapshot and then apply the upgrade and see if this resolves the issue or not?
Note:
Microsoft talked to them about a limited number of synchronized items to their Azure site per week! I am not sure about this but what the customer
said is that they change approximately about 25,000 user object per day.
Could this issue happens because of this limit?
Thanks

Besides the large number of objects in the system, which I am not sure DirSync can handle, I suggest you separate the failing step from other steps in the RunProfile.
So, if you have a step that does Delta Import and Delta Sync, separate into 2 steps;
Best,
Nosh
Nosh Mernacaj, Identity Management Specialist

Similar Messages

How to know via PowerShell "did user install office on his computer with office 365 or not"

Hello. Sorry for my english.
Subject: How to know via PowerShell "did user install office on his computer with office 365 or not"
I set to users Office 365 ProPlus license, that allows a user to install Office on up to five computers. I want to know, user use this opportunity or not, install office or not.
User can view his installation in the Office 365 portal:
But how I (like admin Office365) can view this information? Maybe via PowerShell?
Thank you...

Hi,
Please see the
blog, I copied the part of here:
====
Viewing a list of Office 365 ProPlus installations
A user can see which computers she has installed Office on by signing in to the Office 365 Portal and going to the
software page.
Only the signed in user can see this information. Even if you are the administrator for your organization's Office 365 subscription, you can't see this information in any of your Office 365 administrative views. This also means you can't deactivate
a user's installation of Office on a specific computer. More on deactivation in a bit.
====
If you have further question about Office 365, I recommend you post the question to Office 365 forum:
http://community.office365.com/en-us/f/148.aspx
Regards,
George Zhao
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs.

Users getting synced with wrong upn with office 365

i have users on premise, already registered domain @abc.com, use which are synced with office should also come with @abc.com, but its stamping with @abc.onmicrosoft.com, where to check to fix it? thanks

Hi,
Please make sure you have added the Comodo Root and Intermediate certificate on the Lync Edge server.
Please also check if you add the correct suffix for Edge Server.
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

User Enrollment when you have Azure MFA for Office 365/Azure AD and On-Premise resources

I'm working on setting up MFA for our company and want to establish the following configuration:
implement MFA for Office 365/Azure AD/organizational account
implement MFA for a Windows Server 2008 R2 TS
i've got things working for Azure AD and have installed the Azure MFA Server on a DC. where i'm getting stuck is that it looks like you have to set up a user enrollment portal internally and have the users enroll a second time. we're using Azure
AD Sync between AD and Azure AD, but we are not interested in ADFS. is there any way to use the existing Azure AD enrollment for the internal users authentication?
take care,
Wylie

Not at this time. The MFA Server is currently independent of Azure AD so the MFA enrollment for users are separate. We are working to converge the on-premises and cloud scenarios to make a single enrollment possible for both locations. I don't have a timeline
to announce at this time, but it is in the works.

User name display in Discussion Board - SharePoint 2013 (Office 365)

Hi,
I would like to hide the display of user name of "Created by" and "Replied By" in discussion board.
How to do this setup?
Thanks and best regards,

That's the nature of the web part. Check here:
http://office.microsoft.com/en-us/sharepoint-designer-help/display-data-from-multiple-lists-with-the-content-query-web-part-HA010174134.aspx
The biggest limitation for content query web part is not able to go across site collections... but subsites should be ok.
Enter content by search web part.... new to 2013.
http://msdn.microsoft.com/en-us/library/office/jj163789(v=office.15).aspx

Script to assign licenses to bulk AD synced user's office 365

i have dirsync so all my local ad users are synced with office 365 tenant
Now I am migrating mailboxes and I need to assign licenses to a bulk migrated users using csv
This process requires 2 steps ‘cmdlts’
$usagelocation = “SA”
Set-MsolUser –UserPrincipalName user@domain -UsageLocation $UsageLocation
After defining the location above time to assign the licenses
Set-MsolUserLicense –UserPrincipalName user@domain -AddLicenses company:ENTERPRISEPACK
So how can I script this and use a CSV file?
Also strange thing, I have ran the above to about 13 users manually, I placed the command on a notepad
Copied all lines and past on the PS, after that other users who already had licenses had their licenses removed! So what did I do wrong? I am asking this to make sure the script you will provide will not remove the currently assigned licenses

this script will work for you given the below conditions
1- you have csv file with only one
Column named "UserPrincipalName" and has all users need to be licensed
2- all users in the above file in the format of [email protected]
3- All users are having the same license
$path= Import-Csv -Path "usersFiles.csv"
foreach ($item in $path){
$MSOLUserName= $item.UserPrincipalName
$password = ConvertTo-SecureString "password here" -AsPlainText –Force
$credential = New-Object System.Management.Automation.PsCredential("your username here",$password)
$cred = Get-Credential -cred $credential
Import-Module MSOnline
Connect-Msolservice -cred $cred
$AccountSkuId = "tenantdomain:ENTERPRISEPACK"
$UsageLocation = "SA"
$LicenseOptions = New-MsolLicenseOptions -AccountSkuId $AccountSkuId
Set-MsolUser -UserPrincipalName $MSOLUserName -UsageLocation $UsageLocation
Set-MsolUserLicense -UserPrincipalName $MSOLUserName -AddLicenses $AccountSkuId -LicenseOptions $LicenseOptions

CodeTwo Backup for Office 365 - local backup and recovery of mailboxes

Yesterday wasn't a great day for Office 365: http://community.spiceworks.com/topic/1069483-today-was-not-a-good-day-to-migrate-our-senior-managem...Luckily, downtime is a rare occurrence in the Office 365 world. But as an Office 365 admin you have other forces working against you – mailbox size limits, reckless users, scarce licenses, regulations requiring local storage of documents… Am I forgetting something?That’s why CodeTwo developed an offline backup tool for Office 365 mailboxes. CodeTwo Backup for Office 365 lets you download your users’ data to a local drive, preview backed up items in full detail and restore mailboxes, folders and single items – current or previous versions.Here’s a video overview of the application:
https://www.youtube.com/watch?v=uD1CEwmJKXEYou can trial CodeTwo Backup for Office 365 for 30 days free of...
This topic first appeared in the Spiceworks Community

I don't suspect a problem with your approach, but if you don't mind overkill, this would be very safe::
uninstall dirsync, delete the db
extend the schema
reinstall dirsync (get the newest version) and let it
soft-match everyone.
Your specific questions (I have not tested the below, but assume it to be true):
>>AD schema extension will not break our Office 365 production
environment
I don't believe the dirsync installer makes any decisions based on the AD schema definition. I'd think you will need to do a FULL SYNC (reg
key) once you're done. with the extension, but this doesn't break users.
>>new attributes will sync to the office 365 environment with a null value (by default)
I don't think this will happen. The absence of the attributes today would be similar to "null".
Mike Crowley | MVP
My Blog --
Planet Technologies

Unity Connection Office 365 Single Inbox - 100 Users Limitation

Hi all,
Goiing over the Unity Connection release notes:
Cisco Unity Connection 8.6(2) Support for Microsoft Office 365
Revised 13 April, 2012
In Cisco Unity Connection 8.6(2) and later, you can configure Connection to synchronize voice messages in Connection user's mailbox with the user's Exchange Online mailbox configured on Microsoft Office 365 environment. Microsoft Office 365 is a cloud hosted collaboration solution provided by Microsoft.
Cisco Unity Connection 8.6(2) SU1 is qualified for 100 users with Microsoft Office 365. For scalability beyond 100 users, you need to contact UCBU Product Management team through [email protected] mailer.
Note The integration beyond 100 users will not be supported by TAC until the BU has signed off on it.
I was aware of the 19 users per Unified Messaging account issue, in which we created several UM Service accounts as a temporary fix until Microsoft lifts the limitation. I wasn't aware of the above that there is a limitation to 100 Users total.
There has been a few posts regarding the 19 user/account issue in which the workaround has been to create up to 20 UM accounts to get up to 380 users as a temporary solution.
Any insight as to when this will be lifted or detailed timelines would be great!
Thanks,
Chris

Hey Chris,
I wouldn't go that route as you nicely noted. The specific locales for su2 are not shown
and I'm pretty confident that this bug would carry over to su2 as well
But then again....I could be way off base here
CSCty54979 - 8.6.x release notes should detail what builds are required for locales
Symptom:
Release notes for Unity Connection 8.6(2a) and 8.6(2a)SU1 are not clear about what builds the use of locales (localizations) are supported with and where they can be acquired
Conditions:
Customers wishing to support non-US English (ENU) languages with Unity Connect 8.6.x
Workaround:
For Unity Connection 8.6(2a), you must install ES12 and use the locale files that are labeled as ES12. The locale files are posted on cisco.com for download, but Unity Connection ES12 is not (you will need to open a TAC case and request a copy of 8.6(2)ES12)
For Unity Connection 8.6(2a)SU1, the 8.6(2)ES12 locales should NOT be used. An updated set of locales will be posted for use with this build in the near future (expected by roughly mid to late April 2012). Also note that if you are currently using the 8.6(2)ES12 locales, you should NOT upgrade to SU1 until the SU1 locales are posted to cisco.com so that you can use them.
If su2 is equivalent to ES44 then they aren't shown on this doc either??
http://www.cisco.com/web/software/Voice/pdf/LocalizationSupportforCUCESreleases.pdf
Cheers!
Rob
"May your heart always be joyful
May your song always be sung" - Bob Dylan

Exchange Connector / Office 365 Not matching affected user to AD user

We use Office 365 to host our email services. AD is not synchronized to office 365. We're bringing Exchange on premises soon so there isn't a lot we want to invest in that existing infrastructure. I'm using Service Manager 2012 R2.
I have the ADConnector configured, bringing in Active Directory users/groups/computers.
I've gotten the Exchange Connector running in order to retrieve emails from an "IT Services" Office 365 mailbox and automatically create tickets. Notifications back to the users are working fine.
The problem I'm having is the affected user is not being set properly when a user emails the mailbox and an incident is created. It is setting the Affected User to that user's name, but when I double click the Affected user, it brings up the "User
- <UserName>" screen. All of the information that would be coming in from AD is blank. So that association between my office 365 email address and the AD user account is not being made. Even though it says my name with
correct (username) on the incident as the affected user. And even though my email address is stored inside of AD in the e-mail field.
What am I missing in this process?
Thank you,
Mark

I ended up messing around and added a UPN to AD Domains and Trusts matching the domain of our email accounts through Office 365. I found this because similar preparation is required for AD sync to Office 365, so a proper match can be made.
So for example, if our internal domain is Contoso.Local, and our email addresses are [email protected]
I added a UPN for contosolimited.com in Active Directory Domains & Trusts. Then I changed my UPN in Active Directory Users and Computers (Account tab), to @contosolimited.com.
Now when the AD Connector ran, it set my user CI UPN (in the Extensions tab) to [email protected] I then sent an email to [email protected] and it matched my email correctly to my user CI created by the AD Connector.
Now I just have to run a script against AD to update all user UPNs to @contosolimited.com from @Contoso.local.

Anonymous User forms in Sharepoint 2013 Online (Office 365)

I'm using Sharepoint 2013 online with Office 365.
Is there any way for an anonymous user to communicate with the site using forms (preferably Infopath)?
There are many, many versions of this question on the web, but most answers seem to talk about features I just don't have in Office 365 Sharepoint - such as Application Management in Central Administration, which just isn't there.
The only feature I can find is the Excel Survey in Form Templates. This is at least a start, but what I really want is the ability for an anonymous user (a customer) to submit information into a Custom List using a form; or, second best, in an email (WITHOUT
having to have Infopath Filler installed). this is all do-able for a fully-subscribed user of the intranet site, but I can't afford to buy individual subscriptions for all my customers. Nor do I want them seeing each other's data, or accessing my intranet!
I have spent so long researching this and getting nowhere, and really need to know if it's just a straight 'no, it's impossible', or keep trying.
Thanks
Jonathan

Hi Jonathan,
According to your description, my understanding is that you want to enable anonymous user with forms in SharePoint 2013 Online.
There is a Sandbox solution from CodePlex, it manages anonymous access on Office 365 / SharePoint 2013. Please have a try.
https://anonymous365.codeplex.com/
In addition, I am not an expert for SharePoint 2013 Online, I suggest you create a new thread on SharePoint Online forum, more experts will assist you with SharePoint Online.
SharePoint Online forum:
http://social.technet.microsoft.com/Forums/en-US/home?forum=onlineservicessharepoint
I hope this helps.
Thanks,
Wendy
Wendy Li
TechNet Community Support

Lack of Office 365 (local instal) COM Automation support - need a definitive list of the versions and their support for automation.

I develop an application that does some PowerPoint automation using embedded interop types (C# App - with VB assembly that does the office automation part)
I've started to get reports that the PowerPoint automation is failing on Office 365.
Here is a sample of a typical customer complaint:
not exporting to powerpoint...
We recently migrated from Office2007 to O365. That would be definitely the reason.
But how can we solve this?
I found the following reply to a forum question:
https://social.msdn.microsoft.com/Forums/office/en-US/3c95eea4-641f-4bf0-a166-ecf33177854b/does-desktop-versions-of-applications-in-office-365-packages-support-comautomation?forum=exceldev
But it only states that one version doesn't - and then one version does - doesn't reference a list of all support versions.
Also - later - in that thread - it is shown that the accepted answer is actually incorrect.
A sample of the type of code used to interact is shown here....
    Public Function PositionSlideTitle(ByVal slide As PowerPoint.Slide, ByVal height As Single, ByVal marginX As Single, ByVal marginY As Single) As PowerPoint.Shape
       Dim shapes As PowerPoint.Shapes
       Dim shape As PowerPoint.Shape
       ' get the shapes on the slide
       shapes = slide.Shapes
       ' get the shape that holds the title
       ' if the shapes collection has a title, then this title shape is always in index 1
       If shapes.HasTitle = Office.MsoTriState.msoTrue Then
           ' the title shape can also be accessed by the special property Title
           shape = shapes.Title
       Else
           ' If there was no title - then add one
           shape = shapes.AddTitle()
       End If
       ' position the shape at 0,0 (seems not to want to go there)
       shape.Left = marginX
       shape.Top = marginY
       ' stretch image to fit slide
       shape.Width = slide.Master.Width - (marginX * 2)
       shape.Height = height
       Return shape
   End Function
The project references Microsoft.Office.Interop.PowerPoint, version 11.0.0.0 with it's "Embed Interop Types" set to true.
This has worked for 10+ years, with all versions of office from Office 2003. We still need the application to support Office 2003 - and it still does perfectly, so referencing newer PIA's isn't an option.
Please help.

Great to know that all versions of Office Support Com Automation.
Because the end-users that have made the complaint - are using Office 365 - it wouldn't be the Click2Run edition as you've mentioned - but it's good to know that information, as I wasn't aware there was a possible issue with that - thanks.
I'll just assume then that the end user that sent the following issue is running them with different permission level:
not exporting to powerpoint...
We recently migrated from Office2007 to O365. That would be definitely the reason.
But how can we solve this?
Although - one more thought - I read somewhere that O365 users can install office via the O365 portal - I wonder whether this is the same as Click2Run install - and hence causing the same out-of-process application error you have referred to?
Kind Regards
UPDATE:
Further reading/searching on click-to-run and O365 found the following:
I can't paste links in this forum, but:
technet microsoft com "en-us/library/jj219427.aspx"
Eugene - you may be onto something with the click-to-run issue - that may be the cause of the error in O365 installations - At least now I have a scenario to test against (user info is always difficult to determine exactly how to replicate issues) - Cheers.

Dirsynced user not showing as mail user in Office 365

Hello,
We have an environment that has a on premise Exchange 2010 SP3 server. We have created the hybrid configuration with Office 365. Directory Synchronization is enabled.
At this point we have some on premise users that are showing "Synced with Active Directory" in the O365 portal, but do not have a mail user.
We are in the midst of performing mailbox migrations to Office 365, and the only way to perform the move to Exchange online is for the user to have a Mail user setup in Contacts on the O365 portal.
Ive seen other forums with the option of Remove-MsolUser and removing from recycle bin then allowing another synchronization from on premise.
Ive also read that Microsoft has helped this situation by doing something to the AD Attributes which they do not go into detail about.
Could someone shed on some light to what could be done to add these users as Mail Users to Office 365 without removing them from Office 365 completely?

Hi B Penney,
I helped a customer some time ago with the same problem and in their case, mailboxes had been created because they gave the synced users an Exchange Online License before they had a working Hybrid configuration setup.
Just deleting licenses did not solve the problem and what I did to solve the problem was:
Get-MsolUser -UserPrincipalName [email protected] | Remove-MsolUser
Get-MsolUser -ReturnDeletedUsers -SearchString
[email protected] | select UserPrincipalName, ObjectId
Remove-MsolUser -RemoveFromRecycleBin -ObjectId 41856197-e306-46c5-9cab-41dddbdafec7
Modified an attribute on the user On-Premises and ran Start-OnlineCoexistenceSync
Martina Miskovic

"Office 365 Mailbox" missing for users that are member of Ricipent Management role

Hi,
I have a hybrid setup with Office 365 and one exchange 2013 standard server on-premises.
I currently have an issue with that I have a button after pressing the + under recipient to create a Office 365 mailbox from the ECP, but users that are members of the Recipient Management role don't have that button visible.
What extra permissions are required to be able to create an Office 365 mailbox from the on-premises Exchange?

Hi SeidKrv,
Thanks for your update.
Following article introuduces the permissions that need to assigned before running "New-Mailbox" command.
Please focus on "Recipient Provisioning Permissions" session.
Recipients Permissions
http://technet.microsoft.com/en-us/library/dd638132(v=exchg.150).aspx
Based on the article, it seems both Recipient Management role and Organization Management role are required.
More detailed information on both management role as below:
1. Administrators who are members of the Recipient Management role group have administrative access to
create or modify Exchange 2013 recipients within the Exchange 2013 organization.
2. Administrators that are members of the Organization Management role group have administrative access to the entire Exchange 2013 organization and
can perform almost any task against any Exchange 2013 object, with some exceptions. By default, members of this role group can't perform mailbox searches and management of unscoped top-level management
roles.
Thanks
Mavis Huang
TechNet Community Support

Domain users and local users can't login to reporting service web environment

Hello,
We installed reporting services at one of our customers but aren't able to use domain users to login. We've tried to login with a domain user, a local user but both aren't working. We set the proper permissions for the users on the reports folders.
We can only login with the buildin/administrator account on the local url: http://servername/reports
How can we allow login with domain users on other report manager url's?

Below link may be helpful,
http://social.msdn.microsoft.com/Forums/sqlserver/en-US/623da309-21fa-42a8-905f-1424144a347d/setting-up-a-user-in-ssrs?forum=sqlreportingservices
Regards, RSingh

Formatting a Date based on the user's Locale

I'm having some trouble formatting a date based on the user's locale. I'm aware you can do something like this:
   public static String getAsString( Object dateObject, Locale locale ) {
      DateFormat dateFormat = DateFormat.getDateInstance( DateFormat.MEDIUM, locale );
      return dateFormat.format( dateObject );
However, this is returning something like Jan 21, 2009. I need 01/21/2009. Of course, if this was the UK locale it'd have to be 21/01/2009. Any help would be appreciated.

another issue I'm running into is that when I'm logged in as a users' locale which uses '-' instead of '/' (i.e. 21-01-2009), I get a parse error. Can anyone provide any input? Thanks.
    * Parse a Date
    * @param dateString
    * @param locale
    * @return parsed Date
   public static Object parseDate( String dateString, Locale locale ) {
      DateFormat dateFormat = DateFormat.getDateInstance( DateFormat.SHORT, locale );
      try {
         return dateFormat.parse( dateString );
      catch( Exception exception ) {
         throw new ExceptionUtl( UtlMessageHelper.getMessage( UtlMessageConstants.ERROR_FailedParseDateFromString, dateString ), exception );
    * Format the given value into a DateFormat
    * @param dateObject
    *           Object value to be formatted
    * @param locale
    *           Locale format to use
    * @return dateObject in SimpleDateFormat
   public static String formatDate( Object dateObject, Locale locale ) {
      DateFormat dateFormat = DateFormat.getDateInstance( DateFormat.SHORT, locale );
      if( dateFormat instanceof SimpleDateFormat ) {
         SimpleDateFormat simpleDateFormat = ( SimpleDateFormat )dateFormat;
         String pattern = simpleDateFormat.toPattern();
         if( !pattern.contains( "yyyy" ) ) {
            pattern = pattern.replace( "yy", "yyyy" );
         if( !pattern.contains( "dd" ) ) {
            pattern = pattern.replace( "d", "dd" );
         if( !pattern.contains( "MM" ) ) {
            pattern = pattern.replace( "M", "MM" );
         simpleDateFormat = new SimpleDateFormat( pattern );
         return simpleDateFormat.format( dateObject );
      return null;
   }

3 million user on Local AD to be synchronized with Office 365 FID issue

Similar Messages

Maybe you are looking for