Microsoft has retired DirSync tool and introduced one tool to synchronize your on-premises identities to Microsoft Azure Active Directory. This tool “Azure AD Connect” can be used in both Office 365 only & Azure AD without O365 scenarios to extend your local AD to the cloud. One of the key advantages is the ability to synchronize the password hash of local AD account with Azure AD where the users will have a single identity & password rather than two different sets of credentials. This is a hash of the password hash stored in your local AD not clear text password. This feature is heavily used in Office 365 deployments to provide SSO (Single/Same Sign On) capabilities to the users to provide single consolidated identity.
I’m working on an Exchange 2013 Hybrid setup these days where one of the prerequisites is to setup Directory Synchronization. We have identified the password hash sync is also required in this situation. When I completed the Azure AD Connect setup wizard I got below error at first. If you are unfamiliar with configuring AAD connect you can refer here.
Now surprisingly I cannot connect to Azure AD via PowerShell and got the same error. My credentials were correct and I decided to check that with my laptop (different ISP) and it was a success. Surprisingly the local ISP has some connectivity issues with Office 365 IP ranges and frequent timeouts were evident and then we changed the network path to a different ISP to resolve the issue.
Since the wizard was completed and no accounts were synced, I decided to go for a manual force sync with PowerShell. Notice the path for DirSync binaries; it hasn’t been changed in AAD Connect as well. The option Initial will do a full synchronization where the option delta will do a delta sync only.
C:\Program Files\Microsoft Azure AD Sync\Bin> .\DirectorySyncClientCmd.exe Initial
All the user accounts were properly synced this time but when I tried to login to Office 365 using an AD account it always says that the password is incorrect.
When I tried to review the existing configuration for Azure AD connect I noticed that it reports the password sync as disabled. Uninstalling the tool, installing again and performing couple of full sync were useless and still I was getting the same issue when I’m trying to login.
Verified password sync is disabled via using PowerShell
Following cmdlets have been used to verify above and I noticed password sync was in fact disabled although I checked the option in Azure AD connect setup.
Get-ADSyncAADPasswordSyncConfiguration -SourceConnector <‘LOCAL DOMAIN NAME>
Enabled password sync via PowerShell
Set-ADSyncAADPasswordSyncConfiguration -SourceConnector <‘LOCAL DOMAIN NAME> -TargetConnector <‘xxxxxxx.onmicrosoft.com – AAD’> -Enable $true
After executing above cmdlets and another full synchronization I noticed below error has been logged in Directory Synchronization event log, still with no luck with passwords.
In the Synchronization Service Manager (C:\Program Files\Microsoft Azure AD Sync\UIShell\miisclient.exe) displays status of “stopped-extension-dll-exception” for operations on the Microsoft Azure Active Directory Connector.
The “stopped-extension-dll-exception” error was due to the fact that password policy of Azure AD Sync account, set to expire after a certain number of days. This account is created automatically once you run the Azure AD Connect wizard.
To set the password to never expire following cmdlets were used.
PS C:\> Connect-MsolService
Provide your O365 admin credentials to connect to Azure AD service.
PS C:\> Set-MsolUser -UserPrincipalName <Sync Account UPN> -PasswordNeverExpires $true
- Make sure the sync account is a global administrator in your office 365 tenant. In my case it was not and I have assign the user role Global Administrator to that account. You can refer the original Microsoft Office 365 support article on how to do that here.
- To overcome the “Password Synchronization has not been activated for this company” error is logged in Event Viewer I executed below cmdlet again in PowerShell.
Set-ADSyncAADPasswordSyncState -ConnectorName < ‘xxxxxxx.onmicrosoft.com – AAD’> -Enable $True
Morale of the Story
When I ran the Azure AD Connect wizard for the first time I selected Start the synchronization process ASAP option as below. Due to the issues I have faced with internet connectivity it wasn’t much of a success.
Also I didn’t select the Use an existing service account option during installation. By default, Azure AD Connect will create a local service account for the synchronization services to use in that case the account that wasn’t a global admin. The user role (which should be global admin), password expiration policy & password is unknown in this automatically created account. Therefore I highly recommend to use an existing global administrator account in your O365 tenant to overcome this.
Also always use the Customize option where you have control over additional configuration options such as above service account while setting up Azure AD Connect.