Quick-n-Dirty User Management for Office 365 Hybrid Deployments

Over the past several months, we have deployed Office 365 to dozens of organizations. Several of the larger environments have asked for integration between the on-premise Active Directory environment and the Office 365 environment. For this, Microsoft has provided a roadmap using Active Directory Federation Services (ADFS) and Directory Synchronization (DirSync). This is a great solution for end users, but can be onerous for the system administrator--especially if the customer has been migrated from Exchange 2003.

When running in any sort of Hybrid mode (or having transitioned from Exchange 2003 on-premise), there are two attributes that need to be updated/maintained with the on-premise AD in order to keep things moving along:

- proxyAddresses
- targetAddress

The proxyAddresses multi-valued attribute is used to store all of the various addresses that are bound to a user. These include (but are not limited to) SMTP and X.400 addresses. In an on-premise Exchange environment, this attribute is used to store the addresses assigned by various recipient policies.

The targetAddress attribute stores the unique "onmicrosoft.com" address assigned to each user. During a transition, mail intended for the @domain.com address skips local mailbox delivery and is automatically forwarded to the address stored in this attribute. If the local Exchange server is kept on-line for local SMTP routing, these attributes *must* be populated for each new user, otherwise mail delivery to them from on-premise services utilizing the Exchange environment will fail.

To work around this, I've put together a very low-end script utilizing the Quest ActiveRoles cmdlets. You will need to install these on either a workstation or server in your environment and then then save the follwing script as a .ps1 file (replacing the placeholders with your own) on the same computer where you have installed the ActiveRoles PowerShell environment.

Write-Host "Please enter the Active Directory ID of the user to update:"
$SamID = Read-Host
$PrimaryDomain = "domain.com"
$SecondaryDomain = "domain2.com"
$Office365Domain = "domain.onmicrosoft.com"

Get-QADuser $SamID Set-QADUser -ObjectAttributes @{targetaddress="SMTP$SamID@$Office365Domain"}
Get-QADUser $SamID Add-QADProxyAddress -Address $SamID@PrimaryDomain -Primary
Get-QADUser $SamID Add-QADProxyAddress -Address $SamID@SecondaryDomain
Get-QADUser $SamID Add-QADProxyAddress -Address $SamID@Office365Domain