Very strange behavior with #AzureAD, #MultifactorAuthentication and #ActiveDirectory #Migration. Maybe someone has an idea? Any help is much appreciated.
Situation: As usual we sync our #OnPrem ADs (at the moment five of them) with #AAD and use the mS-DS-ConsistencyGuid as the Source Anchor.
Last year we needed to "move" a user from one OnPrem (H) Domain to another (D). We created a new user in Domain H, removed the user in Domain D from the sync, copy/pasted his mS-DS-ConsistencyGuid from Domain D to Domain H and started the sync of the user in Domain H. So the user used the new credentials from Domain H but kept his 365 Data which he generated before with his account from Domain D.
A few weeks before we integrated #Multifactor #Authentication through #Watchguard #Authpoint MFA and activated it for the whole company and every user in every domain. Now as soon as the user changed his password for the first time since the MFA got in place, it was activated for him and the issues began.
Issue: When trying to logging into 365 with Authpoint MFA, the error message explains, that Azure awaits the the #immutableID based on the ObjectGUID of Domain H. But since we copy/pasted the mS-DS-ConsistencyGuid from the old Domain D, this is based on the ObjectGUID from the user of Domain D and so an authentication does not happen. If we change the immutableID to the awaited based on the ms-DS-ConsistencyGuid of Domain H, the user can log into Azure/365, but obviously the sync stops because ms-DS-Cons and immutableID dont match anymore.
So, for one person, that is maybe something you can do very dirty by editing the data in the metaverse, but unfortunately we are running soon a AD migration project where every user will be migrated to another single domain. So for me it seems like we are a few steps away from everything will explode?
Anybody has a hint/idea/solution/anything else? Every help and #boost is welcome and appreciated.