Agreed, a simple question. But the answer is not that simple… The removal of a federated domain in Office 365 can be a challenging activity, with a lot of manual tasks.
The following approach is really simple. Simple because you don’t have to touch any on-premise object (user and group). This is usually necessary when you want to delete federated users and groups in Office 365 – a pre-requirements before you can remove the entire domain!
But please be aware of the following note:
This approach is NOT supported in a productive environment!
Please use this approach ONLY in a test/development environment!
Unsupported way to remove all federated users and groups
And now this super secret approach, which again, is not supported!
It’s all about the Dirsync tool, that you have to modify – that means, you have to modify the Management Agent (MA) for your on-prem Active Directory. The AD MA can be configured via the Dirsync console, as follows:
Yes, you’re right. The Dirsync tool actually is just a pre-configured MIIS installation. To configure the AD MA, click on the SourceAD MA and select Properties. Then click on the Configure Directory Partitions hub and click the button Containers…
Then follow the following steps…
- Change the password of the MSOL_AD_Sync account OR use another account
- Change the container selection in the SourceAD MA to an empty OU
- Run the Full Import and Full Sync run profile of the SourceAD MA
- Run the Full Confirming Import run profile of the TargetWebService MA
- Run the Export run profile of the TargetWebService MA
Supported way to remove all federated users and groups
The official and supported way to get rid of a federated domain is:
You must update all user accounts that have that domain assigned as the UPN to use a different UPN suffix, either:
1. Update UPNs in Active Directory and then run DirSync to update cloud user accounts’ UPNs.
OR
2. Update UPNs in Active Directory and use the update-MSOLUserPrincipalName cmdlet to manually change the cloud UPN of each user.
