How to Use SMTP Matching to Link On-Premises and Office 365 Users

Integrating on-premises user accounts with Office 365 is essential for seamless identity management, especially for organizations where users may have different account representations across environments. SMTP matching is a common method to establish a link between on-premises user accounts and their Office 365 counterparts based on email addresses. This guide walks you through the process of configuring SMTP matching specifically for directors or high-privilege users to ensure their identities are correctly synchronized and recognized across platforms.

What You’ll Need

• Administrative access to your on-premises Active Directory environment
• Azure AD Connect installed and configured for your organization
• Access to Office 365 admin portal with appropriate permissions
• Knowledge of your on-premises user email addresses and Office 365 user email addresses
• Optional: PowerShell knowledge for advanced troubleshooting

Step-by-Step

1. Ensure Consistent Email Addresses: Verify that the email addresses (SMTP proxy addresses) for your on-premises user accounts match the email addresses in Office 365. Consistency is critical for SMTP matching to work correctly.
2. Configure SMTP Proxy Addresses in Active Directory:
   • Open Active Directory Users and Computers (ADUC).
   • Locate the user account for the director.
   • Right-click the user and select Properties.
   • Navigate to the Attribute Editor tab.
   • Find the proxyAddresses attribute.
   • Add or verify SMTP addresses in the format SMTP;primaryemail@example.com for the primary email and smtp;secondaryemail@example.com for secondary addresses.
   • Save changes.
3. Update Azure AD Connect Settings:
   • Open the Azure AD Connect tool on your synchronization server.
   • Navigate to the Optional Features and ensure Exchange hybrid deployment is enabled if applicable.
   • In the synchronization rules, confirm that the attribute proxyAddresses is being synchronized to Azure AD.
   • If needed, modify the synchronization rule to prioritize SMTP addresses for matching.
4. Force a Directory Sync:
   • Open PowerShell with administrator privileges.
   • Run the command: Start-ADSyncSyncCycle -PolicyType Delta to initiate a delta synchronization.
   • Alternatively, restart the Azure AD Connect sync service for immediate sync.
5. Verify User Matching in Office 365:
   • Log into the Office 365 admin portal.
   • Navigate to Users > Active Users.
   • Search for the director’s account.
   • Check the user’s email addresses and ensure they match the on-premises SMTP addresses.
   • Use PowerShell (e.g., Get-MsolUser -UserPrincipalName) to verify the user attributes if needed.
6. Test the Match: Send an email to the director’s Office 365 account and confirm receipt. Also, verify that the user can log in with their on-premises credentials and access resources as expected.

Common Mistakes

• Using inconsistent or outdated email addresses between on-premises AD and Office 365.
• Not enabling or correctly configuring the proxyAddresses attribute in Active Directory.
• Forgetting to run a delta sync after making changes.
• Modifying synchronization rules improperly, leading to mismatches or synchronization errors.
• Not verifying that the SMTP addresses are in the correct format (SMTP for primary, smtp for secondary).

Tips

• Always back up your Active Directory before making bulk attribute changes.
• Use PowerShell commands to verify synchronization status and attribute values.
• Ensure your Azure AD Connect version is up to date to leverage the latest features and fixes.
• Document the email addresses and synchronization rules for audit and troubleshooting purposes.
• Test changes in a controlled environment before applying them to all users.

Troubleshooting

If SMTP matching does not work as expected, follow these steps:

1. Check Attribute Values: Use PowerShell to verify the proxyAddresses attribute for the user in Active Directory and in Azure AD. Ensure they are correctly populated with matching SMTP addresses.
2. Review Synchronization Logs: Use the Azure AD Connect synchronization service manager to review logs for errors related to user attributes or matching issues.
3. Run a Manual Sync: Trigger a manual sync to ensure changes are propagated immediately.
4. Verify Email Format: Confirm that SMTP addresses are correctly formatted, with the primary SMTP address starting with SMTP; and secondary addresses with smtp;.
5. Check for Duplicate Addresses: Duplicate email addresses across multiple accounts can cause matching issues. Resolve duplicates before syncing.
6. Use PowerShell to Diagnose: Commands like Get-Recipient in Exchange Online or Get-MsolUser can help verify account attributes and matching status.

If issues persist, consider reconfiguring the matching rules or consulting Microsoft support for advanced troubleshooting.

Frequently Asked Questions

1. Why is my on-premises user not matching in Office 365 after SMTP configuration?

It could be due to inconsistent email addresses, incorrect attribute synchronization, or a sync delay. Verify email addresses and force a sync to resolve.

2. Can I match multiple on-premises accounts to the same Office 365 account?

No, SMTP matching relies on unique email addresses. Duplicate addresses can cause conflicts and mismatches.

3. How often should I run directory sync after making changes?

Run manual sync immediately after changes and ensure your sync schedule aligns with organizational needs, typically every 30 minutes to an hour.

4. What should I do if SMTP matching still doesn’t work after troubleshooting?

Check for attribute replication issues, review synchronization rules, and ensure no duplicate email addresses exist. Contact Microsoft support if needed.

5. Is SMTP matching the only way to link on-premises and Office 365 accounts?

No, other methods include objectGUID matching or using Azure AD Connect’s custom rules, but SMTP matching is the most straightforward for email-based identity linkage.

Related

• How to Use Microsoft SwiftKey Keyboard Effectively
• How to Use the Microphone in Dragon Medical One
• How to Use the Mail Merge Manager to Create Mailing Labels or Envelopes in Word 2008 for Mac