Azure AD DirSync Unable to update this object in Azure Active Directory, because the attribute [FederatedUser.UserPrincipalName], is not valid. Update the value in your local directory services.

You have your Active Directory configured for SSO with Office 365, therefore the DirSync (or whatever it’s called this week) tool configured. All of your user accounts are populated into Azure AD, with the exception of one.

In your environment you have a number of UPN Suffixes for various reasons, the proper object is throwing the following error from the DirSync (FIM 2010 R2) interface “Unable to update this object in Azure Active Directory, because the attribute [FederatedUser.UserPrincipalName], is not valid. Update the value in your local directory services.”

On the Connector Space Object Properties page, the error code 0x8023134a DataValidationFailed is also flagged.

This error is logged by DirSync every time the Export Management Agent operation is run, which happens by default every 3 hours. The user account in question recently had it’s UPN Suffixes changed via a full installation of Forefront Identity Manager that is synchronizing identities from Novell eDirectory.

This is a fairly well known issue to Microsoft as they have outlined in this workaround article;

https://support.microsoft.com/en-us/kb/2669550

What they recommend doing is to connect to the Office 365 via PowerShell using Connect-MsolService.

Set-MsolUserPrincipalName –UserPrincipalName user1@oldupn.com –NewUserPrincipalName user1@newupn.com

This command in theory should work, as all it is doing is altering the UPN Suffix, which cannot be done using the Office 365 Web-UI. Unfortunately the gotcha here for me was that the command failed to run, I had to run it twice. Once to change the user account to my .onmicrosoft.com domain, and then again to update the UPN back to one of the internal federated domains.

Set-MsolUserPrincipalName –UserPrincipalName user1@oldupn.com –NewUserPrincipalName user1@domain.onmicrosoft.com

Set-MsolUserPrincipalName –UserPrincipalName user1@oldupn.com –NewUserPrincipalName user1@newupn.com

Once I did this it completely correctly, and I could see the changes from the Web-UI.

Office 365 Configuring Active Directory Synchornization with Azure AD DirSync

Login to your Office 365 tenant and navigate to the Admin Console page, click on Users and then Active Users. From there click Active Directory Sync Set Up

You will then be faced with 7 options, click on option 3 Active Directory Synchronization and click on Active.

You will be asked to confirm you want to ensure Active Directory sync, click Yes.

As I am doing this in a brand new Active Directory I did not bother running the IdFix Tool, but if you are running this in your production Active Directory that may need checking you should run this tool.

Stage 5 requires you to download the Azure AD Dir Sync tool, click Download and it will start, the download is around 200MB's. 

Once the Dir Sync tool has downloaded, double click on the exe file to run the setup. Click Next.

Accept the License Terms and click Next.

The Dir Sync wizard will then begin installing the required components.

Choose to start the configuration wizard.

Click Next.

Enter the credentials you used to configure your Office tenant.

Now local domain credentials are required.

Do not choose to configure a Hybrid Deployment.

Ensure you choose to configure Password Sync as this will be a good fall back if your AD FS infrastructure fails, if DirSync is configured to sync passwords users will still be able to login to Office 365 using their domain credentials.

Kick off a sync job and click Finish.

To test the users have been synced to the Office 365 tenant check with in the console.

Office 365 and Azure Active Directory DirSync Fails with "The Management Agent Windows Azure Active Directory Connector failed on execution. Error returned is 'stopped-extension-dll-exception'. If the problem persists, contact Technical Support."

You are trying to configure the Azure Active Directory DirSync tool to provision on premise Active Directory user accounts to the Office 365 tenant Azure AD instance to allow Same Sign On for domain users. After installing DirSync, you instruct it to “Synchronize Now”, the interface then closes, after sometime you notice that the user accounts are not appearing in Office 365. On investigating the DirSync server, in the Event Viewer under Application Logs there is a number of issues related to the synchronization "The Management Agent Windows Azure Active Directory Connector failed on execution. Error returned is 'stopped-extension-dll-exception'. If the problem persists, contact Technical Support."

I have done a lot of DirSync work so I know it’s a cut down version of FIM under the covers browse to the following path C:\Program Files\Windows Azure Active Directory Sync\SYNCBUS\Synchronization Service\UIShell and double click on miisclient.exe.

The miisclient.exe is the cut down version of the Forefront Identity Manger (FIM) Synchronization Server Manager GUI, this is what Azure AD DirSync is under the covers.

I understand not everyone is skilled up on Forefront Identity Manager itself, so I will highlight some of the details to help better understand this solution. Forefront Identity Manager has what are known as "Management Agents", which are basically connected to external systems that store identity information. The Management Agents are used to import and export identities into the internal FIM database known as the Metaverse.

Therefore using the figure below, imagine you had traditional Active Directory as "External System 1", the FIM Sync Server would import identity information into the FIM Metaverse with an inbound synchronization rule. To push out, identity information to "External System 2" an outbound synchronization rule would be provisioned to copy from the FIM Metaverse to "External System 2". Management Agents (sometimes referred to as connectors) would be required to each of the systems.

With this information in mind, return to the Synchronization Service Manager interface, and click on Management Agents.

You will notice a Management agent for Active Directory and the Azure AD instance that is to be populated for Office 365. 

Click on Operations, and returning to the original issue raised from the event logs "The Management Agent Windows Azure Active Directory Connector failed on execution. Error returned is 'stopped-extension-dll-exception'. If the problem persists, contact Technical Support." you will notice all of the errors with the Status stopped-extension-dll-exception are reported by the Azure Active Directory Management Agent. This suggests that the problem is exporting identity information to Azure AD from DirSync (or FIM Sync Service).

Click on Management Agents and then right click on the Windows Azure Active Directory Connector and select Run.

To flush out the error, I first run a Delta Import Delta Sync Run Profile, which completed successfully. To follow I then run an Export, followed by a Full Import Full Sync. After this the error listed on the Management Agent for Azure AD had disappeared. 

Then to confirm it had worked I checked within the Office 365 tenant administration console, and I could see the test users I created for this test.

It is worth mentioning that you can configure the DirSync (or FIM) tool to only synchronize objects from specific Organization Units (OU's) instead of the entire domain, which is configured by default. You can do that from the Synchronization Server Manager Interface, but click on Management Agents. At this stage, right click on the Active Directory Connector and select Properties...

Then click on Configure Directory Partitions and Containers.

You will have to enter authentication detail and it will then display a list of the entire Active Directory, you can then highlight and deselect at OU level what objects you want synced into FIM, and therefore synced out of FIM to the Azure AD.

Azure Active Directory Sync Tool “A constraint violation occurred.” during Active Directory Sync with Office 365

When you try to run the first sync of your on-premise Active Directory to the Office 365 Azure AD instance you are halted by the error “A constraint violation occurred”, and you can either Cancel the sync or Retry. Performing a Retry does not resolve the issue.

As the Azure Active Directory Sync Tool is actually Forefront Identity Manager 2010 under the covers I thought I would look to see if that was operating correctly. The miisclient.exe is the interface you can use to see and edit the FIM 2010 configurations, it can be found at C:\Program Files\Windows Azure Active Directory Sync/SYNCBUS\Synchronisation Service/UIShell

When I tried to launch miisclient.exe the following error appeared “Unable to connect to the Synchronisation Service”, it was noted this could be related to a service or group membership. As I had seen this issue before with a traditional instance of Forefront Identity Manager I knew this was because the user account I was using was not a member of the FIMSyncAdmins group.

I opened up ADUC and checked the FIMSyncAdmins group and my user account was in there, so I logged out and then in again and rerun the sync job and it worked perfectly.