Collaborate without boundaries

Staged Exchange Migration with Identity Federation in place

Staged Exchange Migration with Identity Federation in place

There are some implementations of Office 365 were a customer implements Identity Federation in order to take advantage of the Single Sign-On capabilities. This customer may have Exchange 2003 or Exchange 2007 on-premises and not want a full hybrid deployment (no Exchange 2010). In this case, the customer would deploy AD FS 2.0 and Directory Synchronization to complete the process of configuring Identity Federation.

The customer would then perform a Staged Exchange Migration to move their mailboxes from their on-premises environment to the cloud. This is done via the Exchange Control Panel in the Office 365 environment, from within the email migrations slab. The directions for this migration options are spelled out here: http://help.outlook.com/en-US/140/ff959224.aspx

The Issue

Assuming the above mentioned scenario matches your deployment, you will need to take extra precautions when creating the CSV file for the Migration batch. The guidance says you need 3 columns such as what is listed below:

EmailAddress

Password

ForceChangePassword

test3@contoso.com

xxxxxxx

TRUE

 

If your CSV file match the above syntax you would fail because of the "ForceChangePassword" field. Office 365 cannot modify that attribute for an Identity Federated users so you would get the error as shown below.

 

migration_users.csv
Started by admin@Contoso.onmicrosoft.com on 10/19/2011 5:13 PM

The mailboxes listed in the following table can't be migrated because they contain errors.
Learn more...

Errors: Mailboxes - 1

test2@contoso.com
A Windows Live error occurred while provisioning for "test2@contoso.com". An internal error occurred while talking to Windows Live. Additional details: "0x800482101033This action is currently blocked for the API. xxxxxxxxx 2011.09.07.15.30.48".

 

To Address this issue you simply need to adjust the CSV file to set the "ForceChangePassword " field to False. This should allow for the migration to succeed. The CSV file will then look like the following:

EmailAddress

Password

ForceChangePassword

test3@contoso.com

xxxxxxx

False

 

-Timothy Heeney (MSFT)

Sort by: Published Date | Most Recent | Most Useful
Comments
  • But doesn't that mean you will need to either reset or get everyone's password?

Page 1 of 1 (1 items)