Power365 Current - GAL Sync Setup Quick Start Guide

Setup Templates

This section provides a step-by-step guide on how to set up GAL Sync for Microsoft 365 Hybrid Tenants.

Setup Environments

To begin at least two (2) hybrid tenants must be configured in Power365 Directory Sync. Each hybrid tenant will consist a cloud environment and a local Active Directory environment.  At the end of this section there will be two (2) hybrid tenants with four (4) local and cloud environments fully configured.

An environment is an end-point connection that can control the scope of objects read. This guide will walk through how to create the source and target hybrid environments.

To create a cloud environment, an Office 365 Global Administrator is required during set up for each tenant. During the initial set up, Power365 Directory Sync will create a new unlicensed user account within each tenant. This account is used to orchestrate some of the PowerShell automation related to directory synchronization services. This account will be created with the Exchange, User and Team Administrator Roles to facilitate its designated jobs.

The Global Administrator account used to set up the environments, is required for directory synchronization services, as it is used to facilitate Graph API related automation activities. The account role can be safely lowered to User, Team and Exchange Administrator once the previously mentioned PowerShell account is created.

To create a local AD environment for the hybrid tenant, the following are required

• One (1) Local Administrator Account for each Microsoft Forest and/or Domain that has permissions to create, update or delete depending on the scope of your Directory Sync workflows.

• One (1) Windows Server to install and host the Power365 Directory Sync Agent.

How to create a cloud environment

Follow these steps to setup the cloud environment endpoints.  

1. Login to Power365

2. Navigate to Environments

3. Click the New button

4. Click Cloud as the environment type, Click Next

5. Name the environment, Click Next

6. The Global Administrator credentials should be in-hand and ready

7. Click the Connect button

8. Login to Microsoft 365

9. Accept the requested Application Permissions

10. Select any discovery group(s) that will be used to determine which objects are part of the environment (See Pro Tip 1)

11. Do not place a check in the “INCLUDE OBJECTS SYNCHRONIZED WITH A LOCAL ACTIVE DIRECTORY VIA AZURE ACTIVE DIRECTORY CONNECT” option as this is a cloud environment with hybrid objects that originate in an On-Premises Active Directory.  For hybrid objects, we will be utilizing Local to Local setup to perform the GAL Sync.

12. Click Next, then Finish

13. Repeat steps 3 – 12 for the next cloud environment

How to create a local environment for the hybrid tenant

Follow these steps to setup the cloud environment endpoints.  

1. Login to Power365

2. Navigate to Environments

3. Click the New button

4. Click Local as the environment type, Click Next

5. Name the environment, Click Next

6. Name the local agent, Click Next

7. Note the agent registration URL and registration Key for later use, click Finish.

8. Install the agent in the Windows Server that is joined to the local AD domain.  Refer to Power365 Online Help Center for detailed information about agent installation and set-up requirements.

9. Once agent is installed and the environment is discovered, click on the Setting button to access the local AD environment setting page.

10. Under General Tab, select the Microsoft 365 tenant from the tenant drop down list under ‘Which cloud environment should this environment associated with?” (See Pro Tip 18)

11. Click on the Organization Unit tab and define the OU filter based on your project scope.

12. Click on the Filters tab and define any LDAP filter based on your project scope.

13. Click Save.

14. Repeat steps 3 – 13 for the next local environment

Before we can build our workflow, it is best to set up your template(s). Templates contain common mappings and settings used to sync Users, Contacts, Devices, Groups, Office 365 Groups and Microsoft Teams. A template can then be applied to any workflow with a Stage Data step.

For the purpose of this guide, the following templates will need to be created GAL objects.  Additional templates may be created for group membership synchronization.

• Cloud to Cloud GAL Sync Source to Target

• Cloud to Cloud GAL Sync Target to Source

• Local to Local GAL Sync

How to create a Cloud to Cloud Source to Target template

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Cloud to Cloud GAL Sync Source to Target”, Click Next

6. Click Cloud as the source environment type, Click Next

7. Click Cloud as the target environment type, Click Next

8. Set CREATE NEW USERS AS = AS-IS (See Pro Tip 19)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Click Next

12. Set CREATE GROUPS AS = SKIP

13. Set UPDATE CREATED GROUPS = DISABLE

14. Set UPDATE MATCHED GROUPS = ENABLE

15. Click Next

16. Set CREATE OFFICE365 GROUPS AND TEAMS AS = SKIP

17. Set UPDATE CREATED CONTACTS = DISABLE

18. Set UPDATE MATCHED CONTACTS = DISABLE

19. Click Next

20. Set CREATE NEW CONTACTS AS = DO NOT CREATE

21. Set UPDATE CREATED CONTACTS = DISABLE

22. Set UPDATE MATCHED CONTACTS = DISABLE

23. Click Next

24. Enter a default password, Click Next

25. Under mappings, we need to make several modifications to the default template in order to make the MEU to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘EmailAddresses’ and double click, enter the below expression under value field. (See Pro Tip 20)

      GetProxyAddresses(null, null, prefix(Result("WindowsEmailAddress"), "SMTP:"), prefix(LegacyExchangeDN, "x500:"))

      Select User as the Target Object Type

    • Select mapping for ‘CustomAttribute1 and double click, enter the below expression under value field. (See Pro Tip 21)

      “s.WindowsEmailAddress”

      Select All as the Target Object Type

26. Leave rest of the mappings as default. 

27. Click Next

28. Click Finish

How to create a Cloud to Cloud Target to Source template

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Cloud to Cloud GAL Sync Target to Source”, Click Next

6. Click Cloud as the source environment type, Click Next

7. Click Cloud as the target environment type, Click Next

8. Set CREATE NEW USERS AS = CONTACT (See Pro Tip 22)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Click Next

12. Set CREATE GROUPS AS = SKIP

13. Set UPDATE CREATED GROUPS = DISABLE

14. Set UPDATE MATCHED GROUPS = ENABLE

15. Click Next

16. Set CREATE OFFICE365 GROUPS AND TEAMS AS = SKIP

17. Set UPDATE CREATED CONTACTS = DISABLE

18. Set UPDATE MATCHED CONTACTS = DISABLE

19. Click Next

20. Set CREATE NEW CONTACTS AS = DO NOT CREATE

21. Set UPDATE CREATED CONTACTS = DISABLE

22. Set UPDATE MATCHED CONTACTS = DISABLE

23. Click Next

24. Enter a default password, Click Next

25. Under mappings, we need to make several modifications to the default template in order to make the MailContact to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘EmailAddresses’ and double click, enter the below expression under value field. (See Pro Tip 20)

      GetProxyAddresses(null, null, prefix(Result("WindowsEmailAddress"), "SMTP:"), prefix(LegacyExchangeDN, "x500:"))

      Select Contact as the Target Object Type

    • Select mapping for ‘CustomAttribute1 and double click, enter the below expression under value field. (See Pro Tip 21)

      “s.WindowsEmailAddress”

      Select All as the Target Object Type

26. Leave rest of the mappings as default.

27. Click Next

28. Click Finish

How to create a Local to Local template

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Local to Local GAL Sync”, Click Next

6. Click Local as the source environment type, Click Next

7. Click Local as the target environment type, Click Next

8. Set CREATE NEW USERS AS = CONTACT (See Pro Tip 23)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Set IF TARGET ADDRESS EXISTS setting as OVERWRITE ONCE.

12. Click Next

13. Set CREATE GROUPS AS = SKIP

14. Set UPDATE CREATED GROUPS = DISABLE

15. Set UPDATE MATCHED GROUPS = DISABLE

16. Click Next

17. Set CREATE NEW CONTACTS AS = DO NOT CREATE

18. Set UPDATE CREATED CONTACTS = DISABLE

19. Set UPDATE MATCHED CONTACTS = DISABLE

20. Click Next

21. Set CREATE NEW DEVICES AS = SKIP

22. Set UPDATE CREATED CONTACTS = DISABLE

23. Set UPDATE MATCHED CONTACTS = DISABLE

24. Click Next

25. Enter a default password, Click Next

26. Leave SYNCHRONIZE SID HISTORY unchecked, Click Next

27. Under mappings, we need to make several modifications to the default template in order to make the MailContact to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘ExtensionAttribute1 and double click, enter the below expression under value field. (See Pro Tip 19)

      “s.mail”

      Select Contact as the Target Object Type

    • Select mapping for ‘DistinguishName and double click, enter the below expression under value field. (See Pro Tip 24)

      GetDn(NewGuid())

    • Select mapping for ‘targetAddress’ and double click, enter the below expression under value field. (See Pro Tip 25)

      prefix(S.mail, "SMTP:")

    • Select mapping for ‘msExchRecipientDisplayType’ and double click, enter the below expression under value field. (See Pro Tip 26)

      "6"

    • Select mapping for ‘msExchRecipientTypeDetails’ and double click, enter the below expression under value field. (See Pro Tip 26)

      "64"

28. Leave rest of the mappings as default or update them based on your project needs.     

29. Click Next

30. Click Finish

Setup Workflow

Follow these steps to create one (1) new workflow for reading, matching, staging and writing data. 

How to create a one-way sync workflow for Cloud to Cloud

1. Login to Power365

2. Navigate to Workflows

3. Click the New button

4. Name and Describe the template, Click Next

5. Select the all four (4) environments (Cloud and Local environments per each hybrid tenant) created previously, Click Next

6. Select ONE-WAY SYNC, Click Next

7. The screen presented next will be a pre-configured set of workflow steps to facilitate the flow of object and attributes between your directories.  (Note, additional steps will be added as part of this guide to facilitate bi-directional synchronization.)

8. Start at the top of the steps, 1. Read From. Click the Select button

9. Select all four (4) environments created previously the click OK

10. Move to Match Objects

1. This is the step where you will decide on how to match existing objects across your hybrid tenant directories

2. Matching is conducted by pairing sets of attributes to find corresponding objects

3. Your four (4) environments may already have some attributes that can be used to find similar objects between the different directories, or you may need to set some to ensure accurate matching

4. For the purpose of GAL Sync, it is most important that email addresses do not conflict before attempting to create new objects in either environment

11. Click the Select button to configure the Match Objects criteria for your source Cloud environment and target Cloud environment

    

    Figure 1: Example Match Objects Criteria

1. Select your source cloud environment from the drop-down menu

2. Select your target cloud environment from the drop-down menu

3. Choose your first attribute pairings, we will use WindowsEmailAddress for our first match criteria

4. Choose the WindowsEmailAddress attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding three (3) additional attribute pairings to our criteria

   1. UserPrincipalName – UPN was added to ensure uniqueness of the local part of the address string. If creating new mail-enabled users in a destination directory it will be important to define any UPN conflicts that may exist

   2. ExternalEmailAddress – This attribute was added to ensure no existing MEUs or Mail Contacts have existing objects with the same external or target address

   3. WindowsEmailAddress to CustomAttribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

12. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your target Cloud environment and source Cloud environment

    

    Figure 2: Example Match Objects Criteria

1. Select your target cloud environment from the drop-down menu on the left as target will now become the source in a bi-directional setup.

2. Select your source cloud environment from the drop-down menu on the right as source will now become the target in a bi-directional setup.

3. Choose your first attribute pairings, we will use WindowsEmailAddress for our first match criteria

4. Choose the WindowsEmailAddress attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding three (3) additional attribute pairings to our criteria

1. UserPrincipalName – UPN was added to ensure uniqueness of the local part of the address string. If creating new mail-enabled users in a destination directory it will be important to define any UPN conflicts that may exist

2. ExternalEmailAddress – This attribute was added to ensure no existing MEUs or Mail Contacts have existing objects with the same external or target address

3. WindowsEmailAddress to CustomAttribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

13. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your source Local environment and target Local environment

    

    Figure 3: Example Match Objects Criteria

1. Select your source local environment from the drop-down menu on the left.

2. Select your target local environment from the drop-down menu on the right.

3. Choose your first attribute pairings, we will use mail for our first match criteria

4. Choose the mail attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding two (2) additional attribute pairings to our criteria

1. Mail to targetAddress – This matching pair created to ensure the system can match onto existing mail contacts in the target with targetAddress pointed to the source mail attribute.

2. Mail to extensionattribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

14. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your target Local environment and source Local environment

    

    Figure 4: Example Match Objects Criteria

1. Select your target local environment from the drop-down menu on the left as target will now become the source in a bi-directional setup.

2. Select your source local environment from the drop-down menu on the right as source will now become the target in a bi-directional setup.

3. Choose your first attribute pairings, we will use mail for our first match criteria

4. Choose the mail attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding two (2) additional attribute pairings to our criteria

1. Mail to targetAddress – This matching pair created to ensure the system can match onto existing mail contacts in the target with targetAddress pointed to the source mail attribute.

2. Mail to extensionattribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

15. Click the Select button to configure the first STAGE DATA workflow task for your Source Cloud to Target Cloud synchronization rule.

1. Select the “Cloud to Cloud GAL Sync Source to Target” template, Click Next

2. Select the source cloud environment as your source, Click Next

3. Select the target cloud environment as your target, Click Next

4. Select the default target domain name, Click Next

5. Configure any Stage Data filter you like, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

6. Click Finish

16. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above. Click the Select button to configure the second STAGE DATA workflow task for your target Cloud to source Cloud synchronization rule.

1. Select the “Cloud to Cloud GAL Sync Source to Target” template, Click Next

2. Select the source cloud environment, Click Next

3. Select the target cloud environment, Click Next

4. Select the default target domain name, Click Next

5. Configure any Stage Data filter you like, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

6. Click Finish

17. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above. Click the Select button to configure the third STAGE DATA workflow task for your source local to target local synchronization rule.

1. Select the “Local to Local GAL Sync” template, Click Next

2. Select the source local environment, Click Next

3. Select the target local environment, Click Next

4. Select the default target domain name, Click Next

5. Select the source Organizational Units that will be in scope of the project by click on the ADD OUS button,

6. In the new OU pop-up window, select the OU that will be in-scope, check the INCLUDE ALL SUB OUS checkbox, click OK to close the pop-up.

7. Configure any Stage Data filter you like by double click on the OU in the OUs list, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

   

   Figure 5: Example Source OU setup.

8. Select the default OU for newly created objects for Users, Groups, Contacts, and Devices.  In our case, we can select the same OU for all object types as we are only syncing user as contact.

   

   Figure 6: Example Target OU setup.

9. Click Finish

18. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above.  Click the Select button to configure the fourth STAGE DATA workflow task for your target local to source local synchronization rule.

1. Select the “Local to Local GAL Sync” template, Click Next

2. Select the target local environment as your source, Click Next

3. Select the source local environment as your target, Click Next

4. Select the default target domain name, Click Next

5. Select the source Organizational Units that will be in scope of the project by click on the ADD OUS button,

6. In the new OU pop-up window, select the OU that will be in-scope, check the INCLUDE ALL SUB OUS checkbox, click OK to close the pop-up.

7. Configure any Stage Data filter you like by double click on the OU in the OUs list, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next

   

   Figure 7: Example Source OU setup.

8. Select the default OU for newly created objects for Users, Groups, Contacts, and Devices.  In our case, we can select the same OU for all object types as we are only syncing user as contact.

   

   Figure 8: Example Target OU setup.

9. Click Finish

19. Click the Select button to configure the WRITE TO workflow task. Ensure all four (4) environments are selected, Click OK

20. Click Next

21. Configure the workflow sync interval, select Manual for now and we can setup a sync schedule once the test sync has completed.  Click Next

22. Setup any workflow alert you may wish to configure, for now, Click SKIP

23. Click Finish

Set up Test Objects

Follow these steps to create one test objects in each environment to validate the GAL Sync workflow.

1. Setup a Remote Mailbox in the source local environment and ensure it is part of the OU filter setup for the Local Environment.

   1. DisplayName: Lab1RMBX1

   2. PrimarySMTPAddress:  Lab1RMBX1@Lab1.Leagueteam.us

2. Setup a Remote Mailbox in the target local environment it is part of the OU filter setup for the Local Environment.

1. DisplayName: Lab2RMBX1

2. PrimarySMTPAddress:  Lab2RMBX1@Lab2.Leagueteam.us

3. Setup a Mailbox in the source cloud environment.

1. DisplayName: Lab1CLDMBX1

2. PrimarySMTPAddress:  Lab1CLDMBX1@Lab1.Leagueteam.us

4. Setup a Mailbox in the source cloud environment.

1. DisplayName: Lab2CLDMBX1

2. PrimarySMTPAddress:  Lab2CLDMBX1@Lab2.Leagueteam.us

5. Capture the LegacyExchangeDN value for the above test objects for later use.

6. Add the test cloud objects as a member of the filter group for the Cloud Environment if filter group is configured when the environment was first configured. 

Validating the Workflow

Follow the below steps to perform the GAL Sync workflow and validation.

1. Select the workflow configured and click on RUN.

2. Allow the workflow execution to complete.

3. Validate Lab1RMBX1 from source local environment will be created in target local environment as Mail Contact.  The target Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as targetAddress

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.

   4. Target Contact’s cn will be created as a random GUID to ensure there will be no name collisions.

4. Validate Lab1CLDMBX1 from source cloud environment will be created in target cloud environment as Mail Contact.  The target Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

5. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress. Validate Lab1CLDMBX1 from source cloud environment will be created in target cloud environment as Mail User.  The Mail User should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.

6. Validate Lab2CLDMBX1 from source cloud environment will be created in target cloud environment as Mail Contact.  The Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.

How to create a Cloud to Cloud Source to Target template

This section provides a step-by-step guide on how to set up GAL Sync for Microsoft 365 Hybrid Tenants.

Setup Environments

To begin at least two (2) hybrid tenants must be configured in Power365 Directory Sync. Each hybrid tenant will consist a cloud environment and a local Active Directory environment.  At the end of this section there will be two (2) hybrid tenants with four (4) local and cloud environments fully configured.

An environment is an end-point connection that can control the scope of objects read. This guide will walk through how to create the source and target hybrid environments.

To create a cloud environment, an Office 365 Global Administrator is required during set up for each tenant. During the initial set up, Power365 Directory Sync will create a new unlicensed user account within each tenant. This account is used to orchestrate some of the PowerShell automation related to directory synchronization services. This account will be created with the Exchange, User and Team Administrator Roles to facilitate its designated jobs.

The Global Administrator account used to set up the environments, is required for directory synchronization services, as it is used to facilitate Graph API related automation activities. The account role can be safely lowered to User, Team and Exchange Administrator once the previously mentioned PowerShell account is created.

To create a local AD environment for the hybrid tenant, the following are required

• One (1) Local Administrator Account for each Microsoft Forest and/or Domain that has permissions to create, update or delete depending on the scope of your Directory Sync workflows.

• One (1) Windows Server to install and host the Power365 Directory Sync Agent.

How to create a cloud environment

Follow these steps to setup the cloud environment endpoints.  

1. Login to Power365

2. Navigate to Environments

3. Click the New button

4. Click Cloud as the environment type, Click Next

5. Name the environment, Click Next

6. The Global Administrator credentials should be in-hand and ready

7. Click the Connect button

8. Login to Microsoft 365

9. Accept the requested Application Permissions

10. Select any discovery group(s) that will be used to determine which objects are part of the environment (See Pro Tip 1)

11. Do not place a check in the “INCLUDE OBJECTS SYNCHRONIZED WITH A LOCAL ACTIVE DIRECTORY VIA AZURE ACTIVE DIRECTORY CONNECT” option as this is a cloud environment with hybrid objects that originate in an On-Premises Active Directory.  For hybrid objects, we will be utilizing Local to Local setup to perform the GAL Sync.

12. Click Next, then Finish

13. Repeat steps 3 – 12 for the next cloud environment

How to create a local environment for the hybrid tenant

Follow these steps to setup the cloud environment endpoints.  

1. Login to Power365

2. Navigate to Environments

3. Click the New button

4. Click Local as the environment type, Click Next

5. Name the environment, Click Next

6. Name the local agent, Click Next

7. Note the agent registration URL and registration Key for later use, click Finish.

8. Install the agent in the Windows Server that is joined to the local AD domain.  Refer to Power365 Online Help Center for detailed information about agent installation and set-up requirements.

9. Once agent is installed and the environment is discovered, click on the Setting button to access the local AD environment setting page.

10. Under General Tab, select the Microsoft 365 tenant from the tenant drop down list under ‘Which cloud environment should this environment associated with?” (See Pro Tip 18)

11. Click on the Organization Unit tab and define the OU filter based on your project scope.

12. Click on the Filters tab and define any LDAP filter based on your project scope.

13. Click Save.

14. Repeat steps 3 – 13 for the next local environment

Setup Templates

Before we can build our workflow, it is best to set up your template(s). Templates contain common mappings and settings used to sync Users, Contacts, Devices, Groups, Office 365 Groups and Microsoft Teams. A template can then be applied to any workflow with a Stage Data step.

For the purpose of this guide, the following templates will need to be created GAL objects.  Additional templates may be created for group membership synchronization.

• Cloud to Cloud GAL Sync Source to Target

• Cloud to Cloud GAL Sync Target to Source

• Local to Local GAL Sync

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Cloud to Cloud GAL Sync Source to Target”, Click Next

6. Click Cloud as the source environment type, Click Next

7. Click Cloud as the target environment type, Click Next

8. Set CREATE NEW USERS AS = AS-IS (See Pro Tip 19)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Click Next

12. Set CREATE GROUPS AS = SKIP

13. Set UPDATE CREATED GROUPS = DISABLE

14. Set UPDATE MATCHED GROUPS = ENABLE

15. Click Next

16. Set CREATE OFFICE365 GROUPS AND TEAMS AS = SKIP

17. Set UPDATE CREATED CONTACTS = DISABLE

18. Set UPDATE MATCHED CONTACTS = DISABLE

19. Click Next

20. Set CREATE NEW CONTACTS AS = DO NOT CREATE

21. Set UPDATE CREATED CONTACTS = DISABLE

22. Set UPDATE MATCHED CONTACTS = DISABLE

23. Click Next

24. Enter a default password, Click Next

25. Under mappings, we need to make several modifications to the default template in order to make the MEU to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘EmailAddresses’ and double click, enter the below expression under value field. (See Pro Tip 20)

      GetProxyAddresses(null, null, prefix(Result("WindowsEmailAddress"), "SMTP:"), prefix(LegacyExchangeDN, "x500:"))

      Select User as the Target Object Type

    • Select mapping for ‘CustomAttribute1 and double click, enter the below expression under value field. (See Pro Tip 21)

      “s.WindowsEmailAddress”

      Select All as the Target Object Type

26. Leave rest of the mappings as default. 

27. Click Next

28. Click Finish

How to create a Cloud to Cloud Target to Source template

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Cloud to Cloud GAL Sync Target to Source”, Click Next

6. Click Cloud as the source environment type, Click Next

7. Click Cloud as the target environment type, Click Next

8. Set CREATE NEW USERS AS = CONTACT (See Pro Tip 22)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Click Next

12. Set CREATE GROUPS AS = SKIP

13. Set UPDATE CREATED GROUPS = DISABLE

14. Set UPDATE MATCHED GROUPS = ENABLE

15. Click Next

16. Set CREATE OFFICE365 GROUPS AND TEAMS AS = SKIP

17. Set UPDATE CREATED CONTACTS = DISABLE

18. Set UPDATE MATCHED CONTACTS = DISABLE

19. Click Next

20. Set CREATE NEW CONTACTS AS = DO NOT CREATE

21. Set UPDATE CREATED CONTACTS = DISABLE

22. Set UPDATE MATCHED CONTACTS = DISABLE

23. Click Next

24. Enter a default password, Click Next

25. Under mappings, we need to make several modifications to the default template in order to make the MailContact to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘EmailAddresses’ and double click, enter the below expression under value field. (See Pro Tip 20)

      GetProxyAddresses(null, null, prefix(Result("WindowsEmailAddress"), "SMTP:"), prefix(LegacyExchangeDN, "x500:"))

      Select Contact as the Target Object Type

    • Select mapping for ‘CustomAttribute1 and double click, enter the below expression under value field. (See Pro Tip 21)

      “s.WindowsEmailAddress”

      Select All as the Target Object Type

26. Leave rest of the mappings as default.

27. Click Next

28. Click Finish

How to create a Local to Local template

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Local to Local GAL Sync”, Click Next

6. Click Local as the source environment type, Click Next

7. Click Local as the target environment type, Click Next

8. Set CREATE NEW USERS AS = CONTACT (See Pro Tip 23)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Set IF TARGET ADDRESS EXISTS setting as OVERWRITE ONCE.

12. Click Next

13. Set CREATE GROUPS AS = SKIP

14. Set UPDATE CREATED GROUPS = DISABLE

15. Set UPDATE MATCHED GROUPS = DISABLE

16. Click Next

17. Set CREATE NEW CONTACTS AS = DO NOT CREATE

18. Set UPDATE CREATED CONTACTS = DISABLE

19. Set UPDATE MATCHED CONTACTS = DISABLE

20. Click Next

21. Set CREATE NEW DEVICES AS = SKIP

22. Set UPDATE CREATED CONTACTS = DISABLE

23. Set UPDATE MATCHED CONTACTS = DISABLE

24. Click Next

25. Enter a default password, Click Next

26. Leave SYNCHRONIZE SID HISTORY unchecked, Click Next

27. Under mappings, we need to make several modifications to the default template in order to make the MailContact to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘ExtensionAttribute1 and double click, enter the below expression under value field. (See Pro Tip 19)

      “s.mail”

      Select Contact as the Target Object Type

    • Select mapping for ‘DistinguishName and double click, enter the below expression under value field. (See Pro Tip 24)

      GetDn(NewGuid())

    • Select mapping for ‘targetAddress’ and double click, enter the below expression under value field. (See Pro Tip 25)

      prefix(S.mail, "SMTP:")

    • Select mapping for ‘msExchRecipientDisplayType’ and double click, enter the below expression under value field. (See Pro Tip 26)

      "6"

    • Select mapping for ‘msExchRecipientTypeDetails’ and double click, enter the below expression under value field. (See Pro Tip 26)

      "64"

28. Leave rest of the mappings as default or update them based on your project needs.     

29. Click Next

30. Click Finish

Setup Workflow

Follow these steps to create one (1) new workflow for reading, matching, staging and writing data. 

How to create a one-way sync workflow for Cloud to Cloud

1. Login to Power365

2. Navigate to Workflows

3. Click the New button

4. Name and Describe the template, Click Next

5. Select the all four (4) environments (Cloud and Local environments per each hybrid tenant) created previously, Click Next

6. Select ONE-WAY SYNC, Click Next

7. The screen presented next will be a pre-configured set of workflow steps to facilitate the flow of object and attributes between your directories.  (Note, additional steps will be added as part of this guide to facilitate bi-directional synchronization.)

8. Start at the top of the steps, 1. Read From. Click the Select button

9. Select all four (4) environments created previously the click OK

10. Move to Match Objects

1. This is the step where you will decide on how to match existing objects across your hybrid tenant directories

2. Matching is conducted by pairing sets of attributes to find corresponding objects

3. Your four (4) environments may already have some attributes that can be used to find similar objects between the different directories, or you may need to set some to ensure accurate matching

4. For the purpose of GAL Sync, it is most important that email addresses do not conflict before attempting to create new objects in either environment

11. Click the Select button to configure the Match Objects criteria for your source Cloud environment and target Cloud environment

    

    Figure 1: Example Match Objects Criteria

1. Select your source cloud environment from the drop-down menu

2. Select your target cloud environment from the drop-down menu

3. Choose your first attribute pairings, we will use WindowsEmailAddress for our first match criteria

4. Choose the WindowsEmailAddress attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding three (3) additional attribute pairings to our criteria

   1. UserPrincipalName – UPN was added to ensure uniqueness of the local part of the address string. If creating new mail-enabled users in a destination directory it will be important to define any UPN conflicts that may exist

   2. ExternalEmailAddress – This attribute was added to ensure no existing MEUs or Mail Contacts have existing objects with the same external or target address

   3. WindowsEmailAddress to CustomAttribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

12. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your target Cloud environment and source Cloud environment

    

    Figure 2: Example Match Objects Criteria

1. Select your target cloud environment from the drop-down menu on the left as target will now become the source in a bi-directional setup.

2. Select your source cloud environment from the drop-down menu on the right as source will now become the target in a bi-directional setup.

3. Choose your first attribute pairings, we will use WindowsEmailAddress for our first match criteria

4. Choose the WindowsEmailAddress attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding three (3) additional attribute pairings to our criteria

1. UserPrincipalName – UPN was added to ensure uniqueness of the local part of the address string. If creating new mail-enabled users in a destination directory it will be important to define any UPN conflicts that may exist

2. ExternalEmailAddress – This attribute was added to ensure no existing MEUs or Mail Contacts have existing objects with the same external or target address

3. WindowsEmailAddress to CustomAttribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

13. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your source Local environment and target Local environment

    

    Figure 3: Example Match Objects Criteria

1. Select your source local environment from the drop-down menu on the left.

2. Select your target local environment from the drop-down menu on the right.

3. Choose your first attribute pairings, we will use mail for our first match criteria

4. Choose the mail attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding two (2) additional attribute pairings to our criteria

1. Mail to targetAddress – This matching pair created to ensure the system can match onto existing mail contacts in the target with targetAddress pointed to the source mail attribute.

2. Mail to extensionattribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

14. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your target Local environment and source Local environment

    

    Figure 4: Example Match Objects Criteria

1. Select your target local environment from the drop-down menu on the left as target will now become the source in a bi-directional setup.

2. Select your source local environment from the drop-down menu on the right as source will now become the target in a bi-directional setup.

3. Choose your first attribute pairings, we will use mail for our first match criteria

4. Choose the mail attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding two (2) additional attribute pairings to our criteria

1. Mail to targetAddress – This matching pair created to ensure the system can match onto existing mail contacts in the target with targetAddress pointed to the source mail attribute.

2. Mail to extensionattribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

15. Click the Select button to configure the first STAGE DATA workflow task for your Source Cloud to Target Cloud synchronization rule.

1. Select the “Cloud to Cloud GAL Sync Source to Target” template, Click Next

2. Select the source cloud environment as your source, Click Next

3. Select the target cloud environment as your target, Click Next

4. Select the default target domain name, Click Next

5. Configure any Stage Data filter you like, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

6. Click Finish

16. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above. Click the Select button to configure the second STAGE DATA workflow task for your target Cloud to source Cloud synchronization rule.

1. Select the “Cloud to Cloud GAL Sync Source to Target” template, Click Next

2. Select the source cloud environment, Click Next

3. Select the target cloud environment, Click Next

4. Select the default target domain name, Click Next

5. Configure any Stage Data filter you like, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

6. Click Finish

17. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above. Click the Select button to configure the third STAGE DATA workflow task for your source local to target local synchronization rule.

1. Select the “Local to Local GAL Sync” template, Click Next

2. Select the source local environment, Click Next

3. Select the target local environment, Click Next

4. Select the default target domain name, Click Next

5. Select the source Organizational Units that will be in scope of the project by click on the ADD OUS button,

6. In the new OU pop-up window, select the OU that will be in-scope, check the INCLUDE ALL SUB OUS checkbox, click OK to close the pop-up.

7. Configure any Stage Data filter you like by double click on the OU in the OUs list, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

   

   Figure 5: Example Source OU setup.

8. Select the default OU for newly created objects for Users, Groups, Contacts, and Devices.  In our case, we can select the same OU for all object types as we are only syncing user as contact.

   

   Figure 6: Example Target OU setup.

9. Click Finish

18. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above.  Click the Select button to configure the fourth STAGE DATA workflow task for your target local to source local synchronization rule.

1. Select the “Local to Local GAL Sync” template, Click Next

2. Select the target local environment as your source, Click Next

3. Select the source local environment as your target, Click Next

4. Select the default target domain name, Click Next

5. Select the source Organizational Units that will be in scope of the project by click on the ADD OUS button,

6. In the new OU pop-up window, select the OU that will be in-scope, check the INCLUDE ALL SUB OUS checkbox, click OK to close the pop-up.

7. Configure any Stage Data filter you like by double click on the OU in the OUs list, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next

   

   Figure 7: Example Source OU setup.

8. Select the default OU for newly created objects for Users, Groups, Contacts, and Devices.  In our case, we can select the same OU for all object types as we are only syncing user as contact.

   

   Figure 8: Example Target OU setup.

9. Click Finish

19. Click the Select button to configure the WRITE TO workflow task. Ensure all four (4) environments are selected, Click OK

20. Click Next

21. Configure the workflow sync interval, select Manual for now and we can setup a sync schedule once the test sync has completed.  Click Next

22. Setup any workflow alert you may wish to configure, for now, Click SKIP

23. Click Finish

Set up Test Objects

Follow these steps to create one test objects in each environment to validate the GAL Sync workflow.

1. Setup a Remote Mailbox in the source local environment and ensure it is part of the OU filter setup for the Local Environment.

   1. DisplayName: Lab1RMBX1

   2. PrimarySMTPAddress:  Lab1RMBX1@Lab1.Leagueteam.us

2. Setup a Remote Mailbox in the target local environment it is part of the OU filter setup for the Local Environment.

1. DisplayName: Lab2RMBX1

2. PrimarySMTPAddress:  Lab2RMBX1@Lab2.Leagueteam.us

3. Setup a Mailbox in the source cloud environment.

1. DisplayName: Lab1CLDMBX1

2. PrimarySMTPAddress:  Lab1CLDMBX1@Lab1.Leagueteam.us

4. Setup a Mailbox in the source cloud environment.

1. DisplayName: Lab2CLDMBX1

2. PrimarySMTPAddress:  Lab2CLDMBX1@Lab2.Leagueteam.us

5. Capture the LegacyExchangeDN value for the above test objects for later use.

6. Add the test cloud objects as a member of the filter group for the Cloud Environment if filter group is configured when the environment was first configured. 

Validating the Workflow

Follow the below steps to perform the GAL Sync workflow and validation.

1. Select the workflow configured and click on RUN.

2. Allow the workflow execution to complete.

3. Validate Lab1RMBX1 from source local environment will be created in target local environment as Mail Contact.  The target Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as targetAddress

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.

   4. Target Contact’s cn will be created as a random GUID to ensure there will be no name collisions.

4. Validate Lab1CLDMBX1 from source cloud environment will be created in target cloud environment as Mail Contact.  The target Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

5. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress. Validate Lab1CLDMBX1 from source cloud environment will be created in target cloud environment as Mail User.  The Mail User should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.

6. Validate Lab2CLDMBX1 from source cloud environment will be created in target cloud environment as Mail Contact.  The Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.

How to create a Cloud to Cloud Target to Source template

This section provides a step-by-step guide on how to set up GAL Sync for Microsoft 365 Hybrid Tenants.

Setup Environments

To begin at least two (2) hybrid tenants must be configured in Power365 Directory Sync. Each hybrid tenant will consist a cloud environment and a local Active Directory environment.  At the end of this section there will be two (2) hybrid tenants with four (4) local and cloud environments fully configured.

An environment is an end-point connection that can control the scope of objects read. This guide will walk through how to create the source and target hybrid environments.

To create a cloud environment, an Office 365 Global Administrator is required during set up for each tenant. During the initial set up, Power365 Directory Sync will create a new unlicensed user account within each tenant. This account is used to orchestrate some of the PowerShell automation related to directory synchronization services. This account will be created with the Exchange, User and Team Administrator Roles to facilitate its designated jobs.

The Global Administrator account used to set up the environments, is required for directory synchronization services, as it is used to facilitate Graph API related automation activities. The account role can be safely lowered to User, Team and Exchange Administrator once the previously mentioned PowerShell account is created.

To create a local AD environment for the hybrid tenant, the following are required

• One (1) Local Administrator Account for each Microsoft Forest and/or Domain that has permissions to create, update or delete depending on the scope of your Directory Sync workflows.

• One (1) Windows Server to install and host the Power365 Directory Sync Agent.

How to create a cloud environment

Follow these steps to setup the cloud environment endpoints.  

1. Login to Power365

2. Navigate to Environments

3. Click the New button

4. Click Cloud as the environment type, Click Next

5. Name the environment, Click Next

6. The Global Administrator credentials should be in-hand and ready

7. Click the Connect button

8. Login to Microsoft 365

9. Accept the requested Application Permissions

10. Select any discovery group(s) that will be used to determine which objects are part of the environment (See Pro Tip 1)

11. Do not place a check in the “INCLUDE OBJECTS SYNCHRONIZED WITH A LOCAL ACTIVE DIRECTORY VIA AZURE ACTIVE DIRECTORY CONNECT” option as this is a cloud environment with hybrid objects that originate in an On-Premises Active Directory.  For hybrid objects, we will be utilizing Local to Local setup to perform the GAL Sync.

12. Click Next, then Finish

13. Repeat steps 3 – 12 for the next cloud environment

How to create a local environment for the hybrid tenant

Follow these steps to setup the cloud environment endpoints.  

1. Login to Power365

2. Navigate to Environments

3. Click the New button

4. Click Local as the environment type, Click Next

5. Name the environment, Click Next

6. Name the local agent, Click Next

7. Note the agent registration URL and registration Key for later use, click Finish.

8. Install the agent in the Windows Server that is joined to the local AD domain.  Refer to Power365 Online Help Center for detailed information about agent installation and set-up requirements.

9. Once agent is installed and the environment is discovered, click on the Setting button to access the local AD environment setting page.

10. Under General Tab, select the Microsoft 365 tenant from the tenant drop down list under ‘Which cloud environment should this environment associated with?” (See Pro Tip 18)

11. Click on the Organization Unit tab and define the OU filter based on your project scope.

12. Click on the Filters tab and define any LDAP filter based on your project scope.

13. Click Save.

14. Repeat steps 3 – 13 for the next local environment

Setup Templates

Before we can build our workflow, it is best to set up your template(s). Templates contain common mappings and settings used to sync Users, Contacts, Devices, Groups, Office 365 Groups and Microsoft Teams. A template can then be applied to any workflow with a Stage Data step.

For the purpose of this guide, the following templates will need to be created GAL objects.  Additional templates may be created for group membership synchronization.

• Cloud to Cloud GAL Sync Source to Target

• Cloud to Cloud GAL Sync Target to Source

• Local to Local GAL Sync

How to create a Cloud to Cloud Source to Target template

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Cloud to Cloud GAL Sync Source to Target”, Click Next

6. Click Cloud as the source environment type, Click Next

7. Click Cloud as the target environment type, Click Next

8. Set CREATE NEW USERS AS = AS-IS (See Pro Tip 19)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Click Next

12. Set CREATE GROUPS AS = SKIP

13. Set UPDATE CREATED GROUPS = DISABLE

14. Set UPDATE MATCHED GROUPS = ENABLE

15. Click Next

16. Set CREATE OFFICE365 GROUPS AND TEAMS AS = SKIP

17. Set UPDATE CREATED CONTACTS = DISABLE

18. Set UPDATE MATCHED CONTACTS = DISABLE

19. Click Next

20. Set CREATE NEW CONTACTS AS = DO NOT CREATE

21. Set UPDATE CREATED CONTACTS = DISABLE

22. Set UPDATE MATCHED CONTACTS = DISABLE

23. Click Next

24. Enter a default password, Click Next

25. Under mappings, we need to make several modifications to the default template in order to make the MEU to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘EmailAddresses’ and double click, enter the below expression under value field. (See Pro Tip 20)

      GetProxyAddresses(null, null, prefix(Result("WindowsEmailAddress"), "SMTP:"), prefix(LegacyExchangeDN, "x500:"))

      Select User as the Target Object Type

    • Select mapping for ‘CustomAttribute1 and double click, enter the below expression under value field. (See Pro Tip 21)

      “s.WindowsEmailAddress”

      Select All as the Target Object Type

26. Leave rest of the mappings as default. 

27. Click Next

28. Click Finish

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Cloud to Cloud GAL Sync Target to Source”, Click Next

6. Click Cloud as the source environment type, Click Next

7. Click Cloud as the target environment type, Click Next

8. Set CREATE NEW USERS AS = CONTACT (See Pro Tip 22)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Click Next

12. Set CREATE GROUPS AS = SKIP

13. Set UPDATE CREATED GROUPS = DISABLE

14. Set UPDATE MATCHED GROUPS = ENABLE

15. Click Next

16. Set CREATE OFFICE365 GROUPS AND TEAMS AS = SKIP

17. Set UPDATE CREATED CONTACTS = DISABLE

18. Set UPDATE MATCHED CONTACTS = DISABLE

19. Click Next

20. Set CREATE NEW CONTACTS AS = DO NOT CREATE

21. Set UPDATE CREATED CONTACTS = DISABLE

22. Set UPDATE MATCHED CONTACTS = DISABLE

23. Click Next

24. Enter a default password, Click Next

25. Under mappings, we need to make several modifications to the default template in order to make the MailContact to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘EmailAddresses’ and double click, enter the below expression under value field. (See Pro Tip 20)

      GetProxyAddresses(null, null, prefix(Result("WindowsEmailAddress"), "SMTP:"), prefix(LegacyExchangeDN, "x500:"))

      Select Contact as the Target Object Type

    • Select mapping for ‘CustomAttribute1 and double click, enter the below expression under value field. (See Pro Tip 21)

      “s.WindowsEmailAddress”

      Select All as the Target Object Type

26. Leave rest of the mappings as default.

27. Click Next

28. Click Finish

How to create a Local to Local template

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Local to Local GAL Sync”, Click Next

6. Click Local as the source environment type, Click Next

7. Click Local as the target environment type, Click Next

8. Set CREATE NEW USERS AS = CONTACT (See Pro Tip 23)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Set IF TARGET ADDRESS EXISTS setting as OVERWRITE ONCE.

12. Click Next

13. Set CREATE GROUPS AS = SKIP

14. Set UPDATE CREATED GROUPS = DISABLE

15. Set UPDATE MATCHED GROUPS = DISABLE

16. Click Next

17. Set CREATE NEW CONTACTS AS = DO NOT CREATE

18. Set UPDATE CREATED CONTACTS = DISABLE

19. Set UPDATE MATCHED CONTACTS = DISABLE

20. Click Next

21. Set CREATE NEW DEVICES AS = SKIP

22. Set UPDATE CREATED CONTACTS = DISABLE

23. Set UPDATE MATCHED CONTACTS = DISABLE

24. Click Next

25. Enter a default password, Click Next

26. Leave SYNCHRONIZE SID HISTORY unchecked, Click Next

27. Under mappings, we need to make several modifications to the default template in order to make the MailContact to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘ExtensionAttribute1 and double click, enter the below expression under value field. (See Pro Tip 19)

      “s.mail”

      Select Contact as the Target Object Type

    • Select mapping for ‘DistinguishName and double click, enter the below expression under value field. (See Pro Tip 24)

      GetDn(NewGuid())

    • Select mapping for ‘targetAddress’ and double click, enter the below expression under value field. (See Pro Tip 25)

      prefix(S.mail, "SMTP:")

    • Select mapping for ‘msExchRecipientDisplayType’ and double click, enter the below expression under value field. (See Pro Tip 26)

      "6"

    • Select mapping for ‘msExchRecipientTypeDetails’ and double click, enter the below expression under value field. (See Pro Tip 26)

      "64"

28. Leave rest of the mappings as default or update them based on your project needs.     

29. Click Next

30. Click Finish

Setup Workflow

Follow these steps to create one (1) new workflow for reading, matching, staging and writing data. 

How to create a one-way sync workflow for Cloud to Cloud

1. Login to Power365

2. Navigate to Workflows

3. Click the New button

4. Name and Describe the template, Click Next

5. Select the all four (4) environments (Cloud and Local environments per each hybrid tenant) created previously, Click Next

6. Select ONE-WAY SYNC, Click Next

7. The screen presented next will be a pre-configured set of workflow steps to facilitate the flow of object and attributes between your directories.  (Note, additional steps will be added as part of this guide to facilitate bi-directional synchronization.)

8. Start at the top of the steps, 1. Read From. Click the Select button

9. Select all four (4) environments created previously the click OK

10. Move to Match Objects

1. This is the step where you will decide on how to match existing objects across your hybrid tenant directories

2. Matching is conducted by pairing sets of attributes to find corresponding objects

3. Your four (4) environments may already have some attributes that can be used to find similar objects between the different directories, or you may need to set some to ensure accurate matching

4. For the purpose of GAL Sync, it is most important that email addresses do not conflict before attempting to create new objects in either environment

11. Click the Select button to configure the Match Objects criteria for your source Cloud environment and target Cloud environment

    

    Figure 1: Example Match Objects Criteria

1. Select your source cloud environment from the drop-down menu

2. Select your target cloud environment from the drop-down menu

3. Choose your first attribute pairings, we will use WindowsEmailAddress for our first match criteria

4. Choose the WindowsEmailAddress attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding three (3) additional attribute pairings to our criteria

   1. UserPrincipalName – UPN was added to ensure uniqueness of the local part of the address string. If creating new mail-enabled users in a destination directory it will be important to define any UPN conflicts that may exist

   2. ExternalEmailAddress – This attribute was added to ensure no existing MEUs or Mail Contacts have existing objects with the same external or target address

   3. WindowsEmailAddress to CustomAttribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

12. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your target Cloud environment and source Cloud environment

    

    Figure 2: Example Match Objects Criteria

1. Select your target cloud environment from the drop-down menu on the left as target will now become the source in a bi-directional setup.

2. Select your source cloud environment from the drop-down menu on the right as source will now become the target in a bi-directional setup.

3. Choose your first attribute pairings, we will use WindowsEmailAddress for our first match criteria

4. Choose the WindowsEmailAddress attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding three (3) additional attribute pairings to our criteria

1. UserPrincipalName – UPN was added to ensure uniqueness of the local part of the address string. If creating new mail-enabled users in a destination directory it will be important to define any UPN conflicts that may exist

2. ExternalEmailAddress – This attribute was added to ensure no existing MEUs or Mail Contacts have existing objects with the same external or target address

3. WindowsEmailAddress to CustomAttribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

13. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your source Local environment and target Local environment

    

    Figure 3: Example Match Objects Criteria

1. Select your source local environment from the drop-down menu on the left.

2. Select your target local environment from the drop-down menu on the right.

3. Choose your first attribute pairings, we will use mail for our first match criteria

4. Choose the mail attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding two (2) additional attribute pairings to our criteria

1. Mail to targetAddress – This matching pair created to ensure the system can match onto existing mail contacts in the target with targetAddress pointed to the source mail attribute.

2. Mail to extensionattribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

14. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your target Local environment and source Local environment

    

    Figure 4: Example Match Objects Criteria

1. Select your target local environment from the drop-down menu on the left as target will now become the source in a bi-directional setup.

2. Select your source local environment from the drop-down menu on the right as source will now become the target in a bi-directional setup.

3. Choose your first attribute pairings, we will use mail for our first match criteria

4. Choose the mail attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding two (2) additional attribute pairings to our criteria

1. Mail to targetAddress – This matching pair created to ensure the system can match onto existing mail contacts in the target with targetAddress pointed to the source mail attribute.

2. Mail to extensionattribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

15. Click the Select button to configure the first STAGE DATA workflow task for your Source Cloud to Target Cloud synchronization rule.

1. Select the “Cloud to Cloud GAL Sync Source to Target” template, Click Next

2. Select the source cloud environment as your source, Click Next

3. Select the target cloud environment as your target, Click Next

4. Select the default target domain name, Click Next

5. Configure any Stage Data filter you like, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

6. Click Finish

16. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above. Click the Select button to configure the second STAGE DATA workflow task for your target Cloud to source Cloud synchronization rule.

1. Select the “Cloud to Cloud GAL Sync Source to Target” template, Click Next

2. Select the source cloud environment, Click Next

3. Select the target cloud environment, Click Next

4. Select the default target domain name, Click Next

5. Configure any Stage Data filter you like, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

6. Click Finish

17. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above. Click the Select button to configure the third STAGE DATA workflow task for your source local to target local synchronization rule.

1. Select the “Local to Local GAL Sync” template, Click Next

2. Select the source local environment, Click Next

3. Select the target local environment, Click Next

4. Select the default target domain name, Click Next

5. Select the source Organizational Units that will be in scope of the project by click on the ADD OUS button,

6. In the new OU pop-up window, select the OU that will be in-scope, check the INCLUDE ALL SUB OUS checkbox, click OK to close the pop-up.

7. Configure any Stage Data filter you like by double click on the OU in the OUs list, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

   

   Figure 5: Example Source OU setup.

8. Select the default OU for newly created objects for Users, Groups, Contacts, and Devices.  In our case, we can select the same OU for all object types as we are only syncing user as contact.

   

   Figure 6: Example Target OU setup.

9. Click Finish

18. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above.  Click the Select button to configure the fourth STAGE DATA workflow task for your target local to source local synchronization rule.

1. Select the “Local to Local GAL Sync” template, Click Next

2. Select the target local environment as your source, Click Next

3. Select the source local environment as your target, Click Next

4. Select the default target domain name, Click Next

5. Select the source Organizational Units that will be in scope of the project by click on the ADD OUS button,

6. In the new OU pop-up window, select the OU that will be in-scope, check the INCLUDE ALL SUB OUS checkbox, click OK to close the pop-up.

7. Configure any Stage Data filter you like by double click on the OU in the OUs list, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next

   

   Figure 7: Example Source OU setup.

8. Select the default OU for newly created objects for Users, Groups, Contacts, and Devices.  In our case, we can select the same OU for all object types as we are only syncing user as contact.

   

   Figure 8: Example Target OU setup.

9. Click Finish

19. Click the Select button to configure the WRITE TO workflow task. Ensure all four (4) environments are selected, Click OK

20. Click Next

21. Configure the workflow sync interval, select Manual for now and we can setup a sync schedule once the test sync has completed.  Click Next

22. Setup any workflow alert you may wish to configure, for now, Click SKIP

23. Click Finish

Set up Test Objects

Follow these steps to create one test objects in each environment to validate the GAL Sync workflow.

1. Setup a Remote Mailbox in the source local environment and ensure it is part of the OU filter setup for the Local Environment.

   1. DisplayName: Lab1RMBX1

   2. PrimarySMTPAddress:  Lab1RMBX1@Lab1.Leagueteam.us

2. Setup a Remote Mailbox in the target local environment it is part of the OU filter setup for the Local Environment.

1. DisplayName: Lab2RMBX1

2. PrimarySMTPAddress:  Lab2RMBX1@Lab2.Leagueteam.us

3. Setup a Mailbox in the source cloud environment.

1. DisplayName: Lab1CLDMBX1

2. PrimarySMTPAddress:  Lab1CLDMBX1@Lab1.Leagueteam.us

4. Setup a Mailbox in the source cloud environment.

1. DisplayName: Lab2CLDMBX1

2. PrimarySMTPAddress:  Lab2CLDMBX1@Lab2.Leagueteam.us

5. Capture the LegacyExchangeDN value for the above test objects for later use.

6. Add the test cloud objects as a member of the filter group for the Cloud Environment if filter group is configured when the environment was first configured. 

Validating the Workflow

Follow the below steps to perform the GAL Sync workflow and validation.

1. Select the workflow configured and click on RUN.

2. Allow the workflow execution to complete.

3. Validate Lab1RMBX1 from source local environment will be created in target local environment as Mail Contact.  The target Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as targetAddress

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.

   4. Target Contact’s cn will be created as a random GUID to ensure there will be no name collisions.

4. Validate Lab1CLDMBX1 from source cloud environment will be created in target cloud environment as Mail Contact.  The target Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

5. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress. Validate Lab1CLDMBX1 from source cloud environment will be created in target cloud environment as Mail User.  The Mail User should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.

6. Validate Lab2CLDMBX1 from source cloud environment will be created in target cloud environment as Mail Contact.  The Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.

How to create a Local to Local template

This section provides a step-by-step guide on how to set up GAL Sync for Microsoft 365 Hybrid Tenants.

Setup Environments

To begin at least two (2) hybrid tenants must be configured in Power365 Directory Sync. Each hybrid tenant will consist a cloud environment and a local Active Directory environment.  At the end of this section there will be two (2) hybrid tenants with four (4) local and cloud environments fully configured.

An environment is an end-point connection that can control the scope of objects read. This guide will walk through how to create the source and target hybrid environments.

To create a cloud environment, an Office 365 Global Administrator is required during set up for each tenant. During the initial set up, Power365 Directory Sync will create a new unlicensed user account within each tenant. This account is used to orchestrate some of the PowerShell automation related to directory synchronization services. This account will be created with the Exchange, User and Team Administrator Roles to facilitate its designated jobs.

The Global Administrator account used to set up the environments, is required for directory synchronization services, as it is used to facilitate Graph API related automation activities. The account role can be safely lowered to User, Team and Exchange Administrator once the previously mentioned PowerShell account is created.

To create a local AD environment for the hybrid tenant, the following are required

• One (1) Local Administrator Account for each Microsoft Forest and/or Domain that has permissions to create, update or delete depending on the scope of your Directory Sync workflows.

• One (1) Windows Server to install and host the Power365 Directory Sync Agent.

How to create a cloud environment

Follow these steps to setup the cloud environment endpoints.  

1. Login to Power365

2. Navigate to Environments

3. Click the New button

4. Click Cloud as the environment type, Click Next

5. Name the environment, Click Next

6. The Global Administrator credentials should be in-hand and ready

7. Click the Connect button

8. Login to Microsoft 365

9. Accept the requested Application Permissions

10. Select any discovery group(s) that will be used to determine which objects are part of the environment (See Pro Tip 1)

11. Do not place a check in the “INCLUDE OBJECTS SYNCHRONIZED WITH A LOCAL ACTIVE DIRECTORY VIA AZURE ACTIVE DIRECTORY CONNECT” option as this is a cloud environment with hybrid objects that originate in an On-Premises Active Directory.  For hybrid objects, we will be utilizing Local to Local setup to perform the GAL Sync.

12. Click Next, then Finish

13. Repeat steps 3 – 12 for the next cloud environment

How to create a local environment for the hybrid tenant

Follow these steps to setup the cloud environment endpoints.  

1. Login to Power365

2. Navigate to Environments

3. Click the New button

4. Click Local as the environment type, Click Next

5. Name the environment, Click Next

6. Name the local agent, Click Next

7. Note the agent registration URL and registration Key for later use, click Finish.

8. Install the agent in the Windows Server that is joined to the local AD domain.  Refer to Power365 Online Help Center for detailed information about agent installation and set-up requirements.

9. Once agent is installed and the environment is discovered, click on the Setting button to access the local AD environment setting page.

10. Under General Tab, select the Microsoft 365 tenant from the tenant drop down list under ‘Which cloud environment should this environment associated with?” (See Pro Tip 18)

11. Click on the Organization Unit tab and define the OU filter based on your project scope.

12. Click on the Filters tab and define any LDAP filter based on your project scope.

13. Click Save.

14. Repeat steps 3 – 13 for the next local environment

Setup Templates

Before we can build our workflow, it is best to set up your template(s). Templates contain common mappings and settings used to sync Users, Contacts, Devices, Groups, Office 365 Groups and Microsoft Teams. A template can then be applied to any workflow with a Stage Data step.

For the purpose of this guide, the following templates will need to be created GAL objects.  Additional templates may be created for group membership synchronization.

• Cloud to Cloud GAL Sync Source to Target

• Cloud to Cloud GAL Sync Target to Source

• Local to Local GAL Sync

How to create a Cloud to Cloud Source to Target template

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Cloud to Cloud GAL Sync Source to Target”, Click Next

6. Click Cloud as the source environment type, Click Next

7. Click Cloud as the target environment type, Click Next

8. Set CREATE NEW USERS AS = AS-IS (See Pro Tip 19)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Click Next

12. Set CREATE GROUPS AS = SKIP

13. Set UPDATE CREATED GROUPS = DISABLE

14. Set UPDATE MATCHED GROUPS = ENABLE

15. Click Next

16. Set CREATE OFFICE365 GROUPS AND TEAMS AS = SKIP

17. Set UPDATE CREATED CONTACTS = DISABLE

18. Set UPDATE MATCHED CONTACTS = DISABLE

19. Click Next

20. Set CREATE NEW CONTACTS AS = DO NOT CREATE

21. Set UPDATE CREATED CONTACTS = DISABLE

22. Set UPDATE MATCHED CONTACTS = DISABLE

23. Click Next

24. Enter a default password, Click Next

25. Under mappings, we need to make several modifications to the default template in order to make the MEU to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘EmailAddresses’ and double click, enter the below expression under value field. (See Pro Tip 20)

      GetProxyAddresses(null, null, prefix(Result("WindowsEmailAddress"), "SMTP:"), prefix(LegacyExchangeDN, "x500:"))

      Select User as the Target Object Type

    • Select mapping for ‘CustomAttribute1 and double click, enter the below expression under value field. (See Pro Tip 21)

      “s.WindowsEmailAddress”

      Select All as the Target Object Type

26. Leave rest of the mappings as default. 

27. Click Next

28. Click Finish

How to create a Cloud to Cloud Target to Source template

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Cloud to Cloud GAL Sync Target to Source”, Click Next

6. Click Cloud as the source environment type, Click Next

7. Click Cloud as the target environment type, Click Next

8. Set CREATE NEW USERS AS = CONTACT (See Pro Tip 22)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Click Next

12. Set CREATE GROUPS AS = SKIP

13. Set UPDATE CREATED GROUPS = DISABLE

14. Set UPDATE MATCHED GROUPS = ENABLE

15. Click Next

16. Set CREATE OFFICE365 GROUPS AND TEAMS AS = SKIP

17. Set UPDATE CREATED CONTACTS = DISABLE

18. Set UPDATE MATCHED CONTACTS = DISABLE

19. Click Next

20. Set CREATE NEW CONTACTS AS = DO NOT CREATE

21. Set UPDATE CREATED CONTACTS = DISABLE

22. Set UPDATE MATCHED CONTACTS = DISABLE

23. Click Next

24. Enter a default password, Click Next

25. Under mappings, we need to make several modifications to the default template in order to make the MailContact to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘EmailAddresses’ and double click, enter the below expression under value field. (See Pro Tip 20)

      GetProxyAddresses(null, null, prefix(Result("WindowsEmailAddress"), "SMTP:"), prefix(LegacyExchangeDN, "x500:"))

      Select Contact as the Target Object Type

    • Select mapping for ‘CustomAttribute1 and double click, enter the below expression under value field. (See Pro Tip 21)

      “s.WindowsEmailAddress”

      Select All as the Target Object Type

26. Leave rest of the mappings as default.

27. Click Next

28. Click Finish

1. Login to Power365

2. Navigate to Templates

3. Click the New button

4. Name and Describe the template

5. In our example, we will name our template “Local to Local GAL Sync”, Click Next

6. Click Local as the source environment type, Click Next

7. Click Local as the target environment type, Click Next

8. Set CREATE NEW USERS AS = CONTACT (See Pro Tip 23)

9. Set UPDATE CREATED USERS= ENABLE

10. Set UPDATE MATCHED USERS= DISABLE

11. Set IF TARGET ADDRESS EXISTS setting as OVERWRITE ONCE.

12. Click Next

13. Set CREATE GROUPS AS = SKIP

14. Set UPDATE CREATED GROUPS = DISABLE

15. Set UPDATE MATCHED GROUPS = DISABLE

16. Click Next

17. Set CREATE NEW CONTACTS AS = DO NOT CREATE

18. Set UPDATE CREATED CONTACTS = DISABLE

19. Set UPDATE MATCHED CONTACTS = DISABLE

20. Click Next

21. Set CREATE NEW DEVICES AS = SKIP

22. Set UPDATE CREATED CONTACTS = DISABLE

23. Set UPDATE MATCHED CONTACTS = DISABLE

24. Click Next

25. Enter a default password, Click Next

26. Leave SYNCHRONIZE SID HISTORY unchecked, Click Next

27. Under mappings, we need to make several modifications to the default template in order to make the MailContact to be compatible with Power365 Tenant to Tenant.  

    • Select mapping for ‘ExtensionAttribute1 and double click, enter the below expression under value field. (See Pro Tip 19)

      “s.mail”

      Select Contact as the Target Object Type

    • Select mapping for ‘DistinguishName and double click, enter the below expression under value field. (See Pro Tip 24)

      GetDn(NewGuid())

    • Select mapping for ‘targetAddress’ and double click, enter the below expression under value field. (See Pro Tip 25)

      prefix(S.mail, "SMTP:")

    • Select mapping for ‘msExchRecipientDisplayType’ and double click, enter the below expression under value field. (See Pro Tip 26)

      "6"

    • Select mapping for ‘msExchRecipientTypeDetails’ and double click, enter the below expression under value field. (See Pro Tip 26)

      "64"

28. Leave rest of the mappings as default or update them based on your project needs.     

29. Click Next

30. Click Finish

Setup Workflow

Follow these steps to create one (1) new workflow for reading, matching, staging and writing data. 

How to create a one-way sync workflow for Cloud to Cloud

1. Login to Power365

2. Navigate to Workflows

3. Click the New button

4. Name and Describe the template, Click Next

5. Select the all four (4) environments (Cloud and Local environments per each hybrid tenant) created previously, Click Next

6. Select ONE-WAY SYNC, Click Next

7. The screen presented next will be a pre-configured set of workflow steps to facilitate the flow of object and attributes between your directories.  (Note, additional steps will be added as part of this guide to facilitate bi-directional synchronization.)

8. Start at the top of the steps, 1. Read From. Click the Select button

9. Select all four (4) environments created previously the click OK

10. Move to Match Objects

1. This is the step where you will decide on how to match existing objects across your hybrid tenant directories

2. Matching is conducted by pairing sets of attributes to find corresponding objects

3. Your four (4) environments may already have some attributes that can be used to find similar objects between the different directories, or you may need to set some to ensure accurate matching

4. For the purpose of GAL Sync, it is most important that email addresses do not conflict before attempting to create new objects in either environment

11. Click the Select button to configure the Match Objects criteria for your source Cloud environment and target Cloud environment

    

    Figure 1: Example Match Objects Criteria

1. Select your source cloud environment from the drop-down menu

2. Select your target cloud environment from the drop-down menu

3. Choose your first attribute pairings, we will use WindowsEmailAddress for our first match criteria

4. Choose the WindowsEmailAddress attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding three (3) additional attribute pairings to our criteria

   1. UserPrincipalName – UPN was added to ensure uniqueness of the local part of the address string. If creating new mail-enabled users in a destination directory it will be important to define any UPN conflicts that may exist

   2. ExternalEmailAddress – This attribute was added to ensure no existing MEUs or Mail Contacts have existing objects with the same external or target address

   3. WindowsEmailAddress to CustomAttribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

12. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your target Cloud environment and source Cloud environment

    

    Figure 2: Example Match Objects Criteria

1. Select your target cloud environment from the drop-down menu on the left as target will now become the source in a bi-directional setup.

2. Select your source cloud environment from the drop-down menu on the right as source will now become the target in a bi-directional setup.

3. Choose your first attribute pairings, we will use WindowsEmailAddress for our first match criteria

4. Choose the WindowsEmailAddress attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding three (3) additional attribute pairings to our criteria

1. UserPrincipalName – UPN was added to ensure uniqueness of the local part of the address string. If creating new mail-enabled users in a destination directory it will be important to define any UPN conflicts that may exist

2. ExternalEmailAddress – This attribute was added to ensure no existing MEUs or Mail Contacts have existing objects with the same external or target address

3. WindowsEmailAddress to CustomAttribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

13. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your source Local environment and target Local environment

    

    Figure 3: Example Match Objects Criteria

1. Select your source local environment from the drop-down menu on the left.

2. Select your target local environment from the drop-down menu on the right.

3. Choose your first attribute pairings, we will use mail for our first match criteria

4. Choose the mail attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding two (2) additional attribute pairings to our criteria

1. Mail to targetAddress – This matching pair created to ensure the system can match onto existing mail contacts in the target with targetAddress pointed to the source mail attribute.

2. Mail to extensionattribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

14. Drag a Match Objects workflow task from the left panel to the right under the Match Object task mentioned above.  Click the Select button to configure the Match Objects criteria for your target Local environment and source Local environment

    

    Figure 4: Example Match Objects Criteria

1. Select your target local environment from the drop-down menu on the left as target will now become the source in a bi-directional setup.

2. Select your source local environment from the drop-down menu on the right as source will now become the target in a bi-directional setup.

3. Choose your first attribute pairings, we will use mail for our first match criteria

4. Choose the mail attribute for the source and target fields

5. To add more attribute pairs, click the Add Attribute button

6. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.

7. In our case we are adding two (2) additional attribute pairings to our criteria

1. Mail to targetAddress – This matching pair created to ensure the system can match onto existing mail contacts in the target with targetAddress pointed to the source mail attribute.

2. Mail to extensionattribute1 – This matching pair is needed to create matching records for new objects created by Power365 DirSync.  

8. Ensure Match Across all object types is checked in this case.

9. Check this box to ensure the workflow is evaluating conflicts regardless of the object type because in two-way GAL sync there may be instances where this condition is true, and we want to ensure you have identified these matches before deciding to create new objects or keep the matches

10. There is no need in this guide to Add Another Pair, click OK to close this configuration

15. Click the Select button to configure the first STAGE DATA workflow task for your Source Cloud to Target Cloud synchronization rule.

1. Select the “Cloud to Cloud GAL Sync Source to Target” template, Click Next

2. Select the source cloud environment as your source, Click Next

3. Select the target cloud environment as your target, Click Next

4. Select the default target domain name, Click Next

5. Configure any Stage Data filter you like, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

6. Click Finish

16. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above. Click the Select button to configure the second STAGE DATA workflow task for your target Cloud to source Cloud synchronization rule.

1. Select the “Cloud to Cloud GAL Sync Source to Target” template, Click Next

2. Select the source cloud environment, Click Next

3. Select the target cloud environment, Click Next

4. Select the default target domain name, Click Next

5. Configure any Stage Data filter you like, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

6. Click Finish

17. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above. Click the Select button to configure the third STAGE DATA workflow task for your source local to target local synchronization rule.

1. Select the “Local to Local GAL Sync” template, Click Next

2. Select the source local environment, Click Next

3. Select the target local environment, Click Next

4. Select the default target domain name, Click Next

5. Select the source Organizational Units that will be in scope of the project by click on the ADD OUS button,

6. In the new OU pop-up window, select the OU that will be in-scope, check the INCLUDE ALL SUB OUS checkbox, click OK to close the pop-up.

7. Configure any Stage Data filter you like by double click on the OU in the OUs list, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next (See Pro Tip 8)

   

   Figure 5: Example Source OU setup.

8. Select the default OU for newly created objects for Users, Groups, Contacts, and Devices.  In our case, we can select the same OU for all object types as we are only syncing user as contact.

   

   Figure 6: Example Target OU setup.

9. Click Finish

18. Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above.  Click the Select button to configure the fourth STAGE DATA workflow task for your target local to source local synchronization rule.

1. Select the “Local to Local GAL Sync” template, Click Next

2. Select the target local environment as your source, Click Next

3. Select the source local environment as your target, Click Next

4. Select the default target domain name, Click Next

5. Select the source Organizational Units that will be in scope of the project by click on the ADD OUS button,

6. In the new OU pop-up window, select the OU that will be in-scope, check the INCLUDE ALL SUB OUS checkbox, click OK to close the pop-up.

7. Configure any Stage Data filter you like by double click on the OU in the OUs list, it is highly recommended to setup filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next

   

   Figure 7: Example Source OU setup.

8. Select the default OU for newly created objects for Users, Groups, Contacts, and Devices.  In our case, we can select the same OU for all object types as we are only syncing user as contact.

   

   Figure 8: Example Target OU setup.

9. Click Finish

19. Click the Select button to configure the WRITE TO workflow task. Ensure all four (4) environments are selected, Click OK

20. Click Next

21. Configure the workflow sync interval, select Manual for now and we can setup a sync schedule once the test sync has completed.  Click Next

22. Setup any workflow alert you may wish to configure, for now, Click SKIP

23. Click Finish

Set up Test Objects

Follow these steps to create one test objects in each environment to validate the GAL Sync workflow.

1. Setup a Remote Mailbox in the source local environment and ensure it is part of the OU filter setup for the Local Environment.

   1. DisplayName: Lab1RMBX1

   2. PrimarySMTPAddress:  Lab1RMBX1@Lab1.Leagueteam.us

2. Setup a Remote Mailbox in the target local environment it is part of the OU filter setup for the Local Environment.

1. DisplayName: Lab2RMBX1

2. PrimarySMTPAddress:  Lab2RMBX1@Lab2.Leagueteam.us

3. Setup a Mailbox in the source cloud environment.

1. DisplayName: Lab1CLDMBX1

2. PrimarySMTPAddress:  Lab1CLDMBX1@Lab1.Leagueteam.us

4. Setup a Mailbox in the source cloud environment.

1. DisplayName: Lab2CLDMBX1

2. PrimarySMTPAddress:  Lab2CLDMBX1@Lab2.Leagueteam.us

5. Capture the LegacyExchangeDN value for the above test objects for later use.

6. Add the test cloud objects as a member of the filter group for the Cloud Environment if filter group is configured when the environment was first configured. 

Validating the Workflow

Follow the below steps to perform the GAL Sync workflow and validation.

1. Select the workflow configured and click on RUN.

2. Allow the workflow execution to complete.

3. Validate Lab1RMBX1 from source local environment will be created in target local environment as Mail Contact.  The target Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as targetAddress

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.

   4. Target Contact’s cn will be created as a random GUID to ensure there will be no name collisions.

4. Validate Lab1CLDMBX1 from source cloud environment will be created in target cloud environment as Mail Contact.  The target Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

5. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress. Validate Lab1CLDMBX1 from source cloud environment will be created in target cloud environment as Mail User.  The Mail User should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.

6. Validate Lab2CLDMBX1 from source cloud environment will be created in target cloud environment as Mail Contact.  The Mail Contact should have the following set:

   1. Source Mailbox’s PrimarySMTPAddress will be added as external email address

   2. Source Mailbox’s LegacyExchangeDN will be added as x500 address.

   3. Source Mailbox’s PrimarySMTPAddress will be added as PrimarySMTPAddress.