Azure Active Directory Connect sync is a great tool. If you are using an on-premise domain environment along side Office 365, and you are not syncing between the two already, I highly recommended doing so! This article is for those who are using AAD Connect already and run into a situation where it makes more sense to have an account that was previously syncing to Office 365 from Active Directory, instead be a cloud only account. One use case for doing this is when a user moves to a limited role and needs to continue accessing their email but does not need access to any other network resources.
The first step you will want to take to break the accounts sync is create an OU that is not being synced via AAD Connect.
The next steps should be coordinated with the user of the synced account, as they will temporarily lose access to their email during this part.
Now that we have our OU created that is not syncing, we can move the account we want to un-sync to it and force a sync. Doing so will cause the account to be deleted from Office 365. Don’t panic! No data will be lost, as Office 365 retains deleted/unlicensed account data for 30 days. Complete the next part to restore the account in Office 365.
Get-MsolUser -ReturnDeletedUsers
. This will return the list of recently deleted mailboxes, you should see the account we are converting here.Restore-MsolUser -UserPrincipalName user@domain.com
. This will restore the user account.At this point, the account in AD is no longer needed. You can treat it like a terminated user account, based on your company’s policies. By using this method to convert an account to cloud only, when only mail access is needed, you will strengthen the security of your network by reducing the points of access.
How can we help you with your Office 365 solution? It’s time to maximize your IT investments.
This publication contains general information only and Sikich is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or any other professional advice or services. This publication is not a substitute for such professional advice or services, nor should you use it as a basis for any decision, action or omission that may affect you or your business. Before making any decision, taking any action or omitting an action that may affect you or your business, you should consult a qualified professional advisor. In addition, this publication may contain certain content generated by an artificial intelligence (AI) language model. You acknowledge that Sikich shall not be responsible for any loss sustained by you or any person who relies on this publication.