zaterdag 15 oktober 2011

How to delete a user from Office 365 which has been synced with Dirsync

I have been testing some things with my account in Office 365.
Unfortunately, where people are testing, thing go wrong.

Somehow, my user in Office 365 got corrupted and all of my things in the cloud were unavailable.
Luckily , it was a test user and no actual data got lost.

First things first. I want to point out that deleting a user in Office 365 using this method also deletes the corresponding mailbox and all the other settings for other Office 365 products.
Only use this as a last effort to delete the user/mailbox.

So, we need to delete the user from Office 365. Easy, just log in to the portal, browse to the user and click delete.
Because the users got synced with Dirsync, AD is leading and therefore the user can't be deleted from the portal.

Well, then I tried deleting the user with Microsoft Online Module for Powershell. ( Installed on ADFS )
First, connecting to the MSOLService and importing the cmdlets to manage Office 365.
Next step was removing the user with the following command.
"Remove-MSOLuser -userprincipalname "userlogonname"
Again, AD is leading so powershell gave me the following error.

Then I thought, AD is leading, Dirsync is ILM, so there must be another way.
And there is! Using the ILM console we can successfully delete a user from Offie 365, without deleting the user in AD.
It is recommended to do this just after a sync, because we don't want Dirsync to start syncing while we are changing things in ILM.

Open the ILM console on the Dirsync server : C:\Program Files\Microsoft Online Directory Sync\SYNCBUS\UIShell\miiclient.exe
Then open the tab " Metaverse Search"
The metaverse is a database that keeps track of user data from all the connected systems.
In this case we only have 2 systems, AD and Office 365.
So in the met averse search we will find one User ( person ) with data from AD and Office 365.

Create a new search scope to find the user you want to delete from Office 365.
Once the user is found, double click the user.

Open the tab "Connectors" .
You will see 2 connectors, one with all the imported data from AD, and one with all the exported data to Office 365.
Select the AD connector ( where Management Agent value is SourceAD) and click "Disconnect" so only the Office 365 connector ( TargetWebService ) remains.
This simulates the user being deleted from AD, as there is no longer any data present for the AD connector.

Next, go to the Management Agents tab.
Right click the "TargetWebService"  connector and choose "Run".
Select the "Full Confirming Import" run profile and click ok.

Repeat the steps above and choose the "Export" run profile instead of the Confirming Import.
When the export is finished, the user object is deleted from Office 365.
This is also shown in the history under the operations tab in ILM.
Click the last task and the deletion will be shown in the bottom left corner.

In the next Sync the user will be recreated in Office 365.

If you want to create a new on-premise mailbox for the user ( because the Online mailbox is deteled, and there is no on-prem mailbox ), there are a couple of extra steps to follow.
If you open the Exchange EMC right away and use the " new-mailbox " command for the just deleted user, you will notice the EMC cannot find your user as it searches for users with no mailbox.

To create a new mailbox for the existing user you have to clear all the exchange attributes in AD for that user. If you open the attribute editor you will notice that all the Exchange attributes remain in AD. If you don't clear the values, Exchange EMC will not create a new mailbox.
Open the properties of a user without a mailbox, and check which attributes had no value.
Clear the ones that don't have a value with the non mailbox enabled user.

Again, only use this as a last effort because all mailbox content is deleted.
If this happens with a normal user instead of a test user, there is a way to get your e-mails back.
With my test user, I opened outlook in Offline mode and created a PST, Cached mode needs to be enabled for this to work!
When the new mailbox was created I imported the PST and the e-mails are back.

Hope you don't have to use this, but it's good to know how a user can be deleted.

19 opmerkingen:

  1. Thank you for the guidance. It is really helpful.

  2. hi,
    i removed a user from O365, from the steps mentioned in your article. but the user is not resyncing back to office 365. what would I need to do to get it working? thanks.
    the steps you mentioned abover were very helpful in removing the user.

    1. Did you check the attributes in AD? As long as the Exchange attributes are not cleared the mailbox / user is not re-created in Office 365.

  3. Very helpful.
    But, If I have many users to remove??

    1. Depends on why you need to remove them. You could also create a filter that excludes the users like I mentioned in my post here : .

  4. "In the next Sync the user will be recreated in Office 365." it is not happening. What do you need to do to recreate the user?

  5. The same: "In the next Sync the user will be recreated in Office 365." it is not happening. What do you need to do to recreate the user?

  6. To recreate the user on next sync try modifying an attribute on the AD object that gets sync'd. For example change add a one to the department attribute in AD after the sync finishes remove it.


  8. Great article. I didn't have to do all those steps. I just disconnected the user, ran a sync to remove the corrupt account from Office 365, then in powershell did Start-OnlineCoexistencesync

  9. Article very interesting and helpful, Thanks

  10. this step is very interesting, i will may try this.

  11. i think this is a good step to deleting a user from office 365. thanks for sharing.

  12. Deze reactie is verwijderd door de auteur.

  13. Great! We are looking to move a few clients to Office 365 from Exchange and are looking for issues we could run into.

  14. Hi everybody, if your need latest Office 2011 SP2 Full with Keys for Mac crack software,most impotent software, you can visit our website( you can also get latest software such as " adobe Photoshop, adobe illustrator, adobe all free software, any converter ,internet accelerator,free antivirus, and another software .so you want to get this software " please click here for visit our website.

  15. Absolutely brilliant solution. This helped us remove an entire directory of service accounts that were unintentionally Dirsync'd, but refused to leave Office 365.

    Thank you!

  16. Deze reactie is verwijderd door de auteur.