Importing users from Azure AD to a fresh local AD

Question

Our organization has been using o365 for quite some time and we just got a server to run Windows Server 2k16 on in order to have better control over our users. How do we go about copying our user accounts from Azure AD to our local Active Directory server in the least disruptive way possible?

Answer 1

There is technet post on this:

https://blogs.technet.microsoft.com/herbchung/2015/04/14/how-to-exportimport-the-identity-from-azure-ad-to-local-ad/

What you need to do is export Azure AD users to CSV with PS amd then import CSV to local AD with PS.

Problem is that passwords aren't moved this way but new passwords are generated, so user will have to reset password on first login.

After users are imported, you might want to sync local and Azure AD in future, here is my post on how to do that:

http://toroman.azurewebsites.net/2016/10/27/azure-basics-part-7-syncing-azure-ad-with-local-ad/

---

Mustafa Toroman, Azure MVP

Answer 2

There is technet post on this:

https://blogs.technet.microsoft.com/herbchung/2015/04/14/how-to-exportimport-the-identity-from-azure-ad-to-local-ad/

What you need to do is export Azure AD users to CSV with PS amd then import CSV to local AD with PS.

Problem is that passwords aren't moved this way but new passwords are generated, so user will have to reset password on first login.

After users are imported, you might want to sync local and Azure AD in future, here is my post on how to do that:

http://toroman.azurewebsites.net/2016/10/27/azure-basics-part-7-syncing-azure-ad-with-local-ad/

---

Mustafa Toroman, Azure MVP

The first link posted mentions ExportOffice365user.ps1 but has no mention of the contents or where to get the script. Would you be able to provide that? I tried using Get-AzureADUser | Export-Csv C:\User.csv but it exports a lot of information. Way more than needed: 

ExtensionProperty

DeletionTimestamp

ObjectId

ObjectType

AccountEnabled

AssignedLicenses

AssignedPlans

City

CompanyName

Country

CreationType

Department

DirSyncEnabled

DisplayName

FacsimileTelephoneNumber

GivenName

IsCompromised

ImmutableId

JobTitle

LastDirSyncTime

Mail

MailNickName

Mobile

OnPremisesSecurityIdentifier

OtherMails

PasswordPolicies

PasswordProfile

PhysicalDeliveryOfficeName

PostalCode

PreferredLanguage

ProvisionedPlans

ProvisioningErrors

ProxyAddresses

RefreshTokensValidFromDateTime

ShowInAddressList

SignInNames

SipProxyAddress

State

StreetAddress

Surname

TelephoneNumber

UsageLocation

UserPrincipalName

UserType

 

                   

Answer 3

Found the script but it is outdated and does not work with MFA or app passwords.

Answer 4

@rivergrade - would you share where the script can be found? It might be usefule to other forum users (such as myself :) )