Office 365 AD FS without Dirsync

With have an on-premise AD and an Office 365 subscription. We are gonna use the o365 only for giving students in our campus free access to Office 365 Pro Plus. For now I have been testing DirSync with password sync with success.
I have now a question; is it possible to use AD FS without DirSync as the only goal is to give access to Office 365 Pro Plus and as we only sync the mimimum attributes required? I read many times that it is not recommended but as we will not use any others
cloud services, what is the good answer?
Another thing: I do manage a child domain. Another team manages the parent domain. I can read here
http://technet.microsoft.com/en-us/library/jj205461.aspx that "When the top-level domain is set up for single sign-on, all subdomains are automatically set up as well."
So is it possible for us to use AD FS between our child-domain and Azure and the other team to use AD FS between their parent domain and Azure without problems?
BR

Hi SupportS2L,
It sounds to me like you probably already have the best solution for your environment in place.
If you simply want to provide students easy access to any services hosted from 365 using the same password as on premise AD DirSync really is all you need. You then control which services in O365 you want them to access from the O365 admin portal as im sure
you already are.
DirSync is a prerequisite of ADFS so I don't believe you would be able to run ADFS without DirSync. I have seen some TechNet blogs that explain how you can operate ADFS without DirSync functioning but only for the purposes of
testing before you finalise the SSO setup with DirSync. Remember that when you implement ADFS you change the authentication point on O365 from the highly available cloud to your on premise ADFS and ADFS Proxy setup so high availability is a must
and can get expensive for the relevant server and network infrastructure.
Thanks

Similar Messages

Office 365 with mailboxes and dirsync without Exchange on-premises

I currently have Active Directory deployed on premises without Exchange. I am migrating my e-mail to Office 365 from a third-party service and want to use dirsync + password sync so my users can use the on premises credentials and Office
365.
Since I do not have Exchange installed on premises (and therefore do not have the Exchange on premises management tools), how do I manage the mailboxes for the synchronized users? I know I cannot change e-mail related attributes, such as e-mail addresses,
directly in Office 365 for synchronized users.
Thanks!

If you are going to use dirsync, the local AD will be the source of authority, so only a very limited subset of attributes can be edited directly in the cloud (either via the EAC or EO PowerShell). It's a very good idea to extend the AD with the Exchange
attributes, as you will definitely need to manage some of those. For more info you can review for example this article:
http://technet.microsoft.com/en-us/library/hh852478.aspx
After you have installed Exchange and thus extended the schema, you can safely remove the Exchange server right away. All the needed attributes will be available via dsa.exe, or AD module for PowerShell.
I would also recommend creating distribution groups directly in the cloud, because even with the extended schema, you will run into some management issues. You can read more about it here:
http://support.microsoft.com/kb/2417592

Can I migrate users from a hosted Exchange 2010 to Office 365 Enterprise E1 without the need of third party software?

I am hoping I am posting to the correct forum. We are currently using a hosted Exchange 2010 service through Intermedia and due to continuing issues with them and the pricing, we are getting ready to migrate to Microsoft’s Office 365 Enterprise
E1 platform. My question is this, besides the fact that we will need to set up ADFS for SSO, will I be able to migrate our existing mailboxes from Intermedia to Office 365 without having to purchase additional software?
The current configuration we have with Intermedia allows for us to use OWA and our OST files for our current users are cached locally on the workstations.
We also do not have any public folders in use. I have searched the web, but I have not been able to find a definitive answer or steps that I should take to prepare for this type of migration.
Any suggestions on this matter would be appreciated. Thank you.

It looks as I should be able to from reading that article. Not sure why the company that want to set this all up for me wanted $12,000 for something I can do with 6 steps.
Thank you

Removing Exchange 2007 from SBS 2008 after Migrating to Office 365 Mid Sized with DirSync and SSO

We have recently completed off a Migration of Exchange 2007 to Office 365 Mid Sized platform.
I now need to decomission the old SBS 2008 server as they have moved to a Windows Server 2012 R2 server setup for DC, File and print and application servers.
I need to know what are the ramifications of removing the Exchange 2007 server from the SBS 2008 server and will this remove the LegacyDN details from AD and cause any issues with internal emails between users using Outlook linked through to Office365.
I understand that after removing Exchange 2007 there will be no friendly GUI to update and maintain proxyAddress, targetAddress and LegacyDN addresses, I am comfortable doing this in ADSI edit or with a script.
Will this remove the x500 addresses relating to the on premise Exchange Orgainisation and just leave behind the x500 addresses for Exchange Labs which I assume is the x500 addresses for the Azure AD intergration for Office365.

Hi ,
Thank you for posting your issue in the forum.
I am trying to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience.
Thank you for your understanding and support.
Best Regards,
Andy Qi
Andy Qi
TechNet Community Support

Office 365 Lync and AD photo setting.

Hi all
We have Office 365 and ADFS and we use Lync online 365.
How we can force the Lync client using only AD´s photo?
Please help.

From My understanding using Dirsync has limit on the size of photo it can sync from on-premise AD
thumbnailphoto
Read
Read
Persons Photo - 10kb maximum size limit
http://support.microsoft.com/kb/2256198
Office 365 customers can set the thumbnailPhoto attribute in on-premise Active Directory to have user photos synchronized to Office 365 via Directory Synchronization (DirSync). Exchange Online limits photo size to 10KB. The script sample obtains photo size
from Active Directory
https://gallery.technet.microsoft.com/office/Office-365-thumbnailPhoto-e2755b03
You can try this
PLEASE REMEMBER, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answered"

Office 365 Shared Mailboxes - Auto Reply

We've just migrated from an exchange 2003 to Office 365.
We have several shared mailboxes where previously they had an out of office setup with a generic message on it. Now that those mailboxes have been turned into'Office 365 Shared Mailboxes' without licenses attatched, i can't seem to work out how to
setup a similar auto reply for each of the mailboxes.
The only thing i can see is to assign a license to each of the mailboxes that we want to have an auto reply and treat them as normal users, but this just seems a waste of money.
Any Help?

It appears you may have bumped into a limitation of Office 365.
You might try this workaround. License the mailbox, log in, set the out of office message, log out, and remove the license. If the out of office message stays, then you have your workaround. Please post here whether or not that works so
others will benefit from your experience.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Disabling AD Autodiscover while migrating to Office 365

I'm in the middle of migrating from Exchange 2007 to Office 365. I can autodiscover to the Office 365 service successfully in every instance except when I'm on a PC joined to the AD domain and the domain is accessible. I have added a registry
key on my test PC that keeps it from using the AD SCP to autodiscover but it still gets my Exchange server mailbox instead of the Office 365 mailbox even without using SCP.
If I remove the PC from the domain, it works both locally and remotely so I know all my other settings are okay, it's only giving me this issue when it's a domain member and is running local to the AD domain. Tried a laptop, joined it to the domain,
took it home and let it autoconfigure, worked great. Same laptop, when local to the domain, tries to autoconfigure using the local Exchange server settings.
I'd like to give my users back their Outlook (rather than OWA) after I migrate them. How do I prevent my locally deployed, AD-joined computers from getting autodiscover info from my local Exchange CAS server while I complete my migration to Office
365?

Hi,
I ran into the same problem. I came up with a work around but I’m not sure this is the correct approach.
First, with Outlook 2010 already installed I had to run the Set up and configure your Office desktop apps from Office 365. I’m not sure of all the configuration changes this makes but I know after you install it that it will allow
you to change the username field when trying to authenticate to Office 365 (will get back to that in a minute)
Second, from my domain joined computer where outlook was connected to my on premise exchange 2007 server mailbox, I setup a new outlook account, either from the control panel mail icon, or from within outlook (both worked) Note; doing from within your already
existing configured outlook allowed me to migrate my email from on-premise to office 365.
From Control Panel/Mail , I created profile name “Office 365”
In the next window it then auto discovered my on premise exchange mailbox email address
[email protected] (which in my case is the same as the office 365 email address
[email protected] )
I replaced the email address with the secondary domain email address that Microsoft office 365 created
[email protected]. I did not put in password at this point and clicked next. It then searched for mailbox, a windows security mail application windows will pop up.
This is where I then replace username
[email protected] with
[email protected] and put in my office 365 account password.
As mentioned above when I said I would get back to that in a minute, if you don’t run the
Set up and configure your Office desktop apps from Office 365. You will not have the option to replace the username from the windows security mail application windows.
It finishes configuration and you’re now connected.
Worth mentioning though that I’m still having some funky mail delivery issues with on-premise users with my imported “contacts” in outlook. The contacts work from office 365 web apps, but not from outlook. If I type the address everything
is fine, but using contacts or replying to on-premise users is giving me some grief. It’s a contact issue but I’m still unable to resolve it.

Office 365 minimum Attributes required for Sync

Hi Fellows,
One of the client has acquired Office 365 ProPlus and have a restricted/secured environment in place.
They require not to sync most of the attributes from AD.
I need to know what is the MANDATORY attributes required to sync with Office 365 Azure AD for DirSync.
Regards.
J.A

Hi,
These links should help:
http://social.technet.microsoft.com/wiki/contents/articles/19901.list-of-attributes-that-are-synced-by-the-windows-azure-active-directory-sync-tool.aspx
http://technet.microsoft.com/en-us/library/hh852478.aspx
Also, this is the forum to discuss questions and feedback for Microsoft Office Client, better to post your question to the forum of Office 365 Community:
http://community.office365.com/en-us/f/default.aspx
The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us. Thank you for your understanding.
Thanks,
Ethan Hua CHN
TechNet Community Support

Not able to set security group without mail enabled as site collection admin using powershell in sharepoint online site - office 365

not able to set security group without mail enabled as site collection admin using powershell in sharepoint online site - office 365?
Any idea?

after few days test in my lab, I can see that only email enabled group can be added as site collection admin using POWERSHELL.
hope this helps who stuck like me!! :-)

Upgrading DirSync for Office 365

Is there a good technical document on the upgrade process from DirSync
6092.42 to latest version
6553.0002 ? and are there any known issues (or bugs) people have encountered ?

Hi,
This is the forum to discuss questions and feedback for Microsoft Office client. There is not so much about
Office 365 Server/Directory integration aspects here, I would suggest you to post in the dedicated forum of
Office 365 Community, where you can get more experienced responses:
http://community.office365.com/en-us/f/default.aspx
The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us. Thank you for your understanding.
Regards,
Ethan Hua
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs.

Project Pro for Office 365 without Office 365 subscription

I've been looking for hours and can't determine if I have to have an Office 365 subscription to purchase Project Pro for Office 365. I have a user at our organization that needs Project Pro. There are no Office 365 accounts. The price point
of <$30/month seems more attractive than the $1,200 up front cost.
If I do need an account, does that mean I have to pay for the cost of an Office 365 account as well, or is that included?
Can there be an Office 365 account on a computer already running Office 2013? or will it conflict with products already installed? I can't believe there's no readily available answers anywhere on their website or under the product information.
Everyone just seems to assume that you're running Office 365 already.

I believe you can purchase Project Pro through a subscription without also purchasing Office 365 (Word, Excel, PowerPoint). What is not included if you don't have an Office subscription is you wouldn't have SharePoint nor Lync nor Excel (used for Visual
Reports in Project).
I agree the documentation is confusing but I think the reference to Office 365 is the deployment method of running Project as an SaaS (software as a service) application.
It is reverse of what you are talking, but I successfully run Project as an MSI installation alongside an Office 365 subscription.
One way to check its functionality with your current installation is to install a trial version.

DirSync AD Attributes for Office 365 ProPlus services.

Hello,
I am installing Directory Synchronization tool on my DirSync server. By default it syncs lots of AD attributes to cloud. What are the minimum Ad attribute requirements that must be synced to cloud for proper authentication to Office 365 ProPlus services.
Thanks
NerKO

Actually DirSync has been around a lot longer than O365, both ADAM and ADLDS leverage dirsync. FIM itself started as MIIS, which Microsoft acquired in 1997. It has gone through various iterations since them from ILM to FIM.
It is not reverse engineering to use Dirsync to synchronize objects between directories. FIM gives one the ability to transform objects and attributes during the synchronization and easily connect multiple LDAP sources.

Implications of changing UPN suffix in preparation for Office 365 & DirSync

Hi,
I hoping someone can add their experience and recommendations for implementing DirSync with a new Office 365 installation. My client's current UPN suffix is xxx.local. We need to change this to their routable internet address of xxx.com. I've read how
to add the suffix to the domain and I've seen some posts about how to script this conversion.
http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/4e4cc3d7-8774-4978-8d52-04a5b5994923
Is it as simple as this above thread describes? Any gotchas to watch out for? Thanks!

Hello,
for Office365 there is a specific forum
http://community.office365.com/en-us/forums/default.aspx
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://msmvps.com/blogs/mweber/
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

Office 365 Basic end user authentication using API without using powershell

I have an Office 365 username and password. I need to authenticate the credentials without using powershell. I mean by using REST API. I was able to authenticate the admin user using client id and secret along with their username and password.
All I need is to authenticate an end user using his username and password using graph api or any REST api.

So you probably need to ask in the dedicated O365 forum:
http://community.office365.com/en-us/f/default.aspx
Or maybe an Azure AD forum ?
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

I've just bought Office 365 Personal, without realising there is a University version. I'm due to start University in two weeks, is there any way I can convert my account to the University version? Or uninstall my current version and replace it?

I've just bought Office 365 Personal, without realising there is a University version. I'm due to start University in two weeks, is there any way I can convert my account to the University version? Or uninstall my current version and replace it?

Contact Microsoft and ask them. These forums are for troubleshooting technical issues with Apple products and not related to Office or your question in any way.

Office 365 AD FS without Dirsync

Similar Messages

Maybe you are looking for