Azure AD Sync

How did you switch to Azure AD Sync? 

Whats the current status of Azure AD Sync in Central? 

Or did you "only" active Server connection? 

i don't know exactly how the switch was made because my colleague did it with sophos support.
sophos support had to delete something before we could use azure ad sync.
the status of azure ad sync is: users and groups successfully synchronized
last sync: March 1, 2020 10:20
user: 1532
Groups: 5039

You should interact with Sophos Support once again, because there could be an mistake in the process. 

As far as i know, you have to delete the AD Sync objects before enabling Azure AD Sync. 

So please contact the Support to get this figured out. 

Hi Tolik 

Would you please check this article and verify the settings?

Hi,

I have already read this article and also carried out the app registration in Azure again, but didn't help.

Hi Tolik 

I will check this with my team and shall get back to you, meanwhile could you please DM me the case number which you have already registered Support? 

Hi Tolik 

I am assuming that you had on-prem AD sync in place before two weeks and you just turned on the Azure AD sync. 

While it is not possible to convert from one to the other, it is possible to switch if you first delete all of the existing AD objects (users, groups, folders) prior to switching AD Sync tools.

• Disable the AD Sync tool/client to prevent importing users and mailboxes
• Remove all existing users and mailboxes before syncing with Azure
• Uninstall all of their Sophos endpoint software before the switch and then reinstall after the switch
• Raise a Technical Support case with details/confirmation the above steps have been completed, and that you would like to request Engineering to Reset AD tasks.

Other important notes about the difference when using Azure AD:

• Sophos Azure Active Directory synchronization supports Sophos Endpoint Protection and Sophos Email Gateway. It has not been tested with other Sophos products.
• You must use an account that has been domain joined to Azure AD while installing the endpoint client.
• Azure AD Sync does not import any device data.
• Azure AD Sync does not support Mac endpoints.

Hi there,

thanks for the steps. We already had a support case for 2 weeks ago and the Technical Support did an AD Task reset ... but we didn't get any information, to deleted all user/groups before.

And reinstalling the endpoints is too much work ... we have over 5000 clients ...

Then we have to do AD sync again. With AD Sync we always had to import the shared mailbox manually via csv because they didn't sync. is there a better solution?

Hi there,

thanks for the steps. We already had a support case for 2 weeks ago and the Technical Support did an AD Task reset ... but we didn't get any information, to deleted all user/groups before.

And reinstalling the endpoints is too much work ... we have over 5000 clients ...

Then we have to do AD sync again. With AD Sync we always had to import the shared mailbox manually via csv because they didn't sync. is there a better solution?

Hi Tolik 

Please speak to Sophos Support for this. There are no other alternatives to this. They should be able to identify any issues. You can not move from Azure AD sync to AD sync without assistance from the Support team as there are some backend changes to be done.

Hello everybody,

thanks for the information, I am now waiting for the message from technical support.

As a test, we have now set up a new subunit in central. And it doesn't work there either ...

Azure Sync says that everything was successful, but no users and mailboxes there ...

best regards

Tolik

Hi Tolik,

As the issue could be replicated on a new account in Central, I suspect the application credentials may be limited on the Azure side.  Does the application credentials have permissions Directory.Read.All?