






Until later,




Will the permissions work both ways?


What do I need to do to make this work?





  3. In the properties window, navigate to mailbox delegation
  5. Click save.




For example:



What will my users see?




  1. Hi Michael

    I’m and avid follower of your work and really want to pick your brain on a single point. I’m currently deploying dual hybrids for 2 London councils. In your TechEd 2014 session which I attended in Barcelona. Which in the recorded version at at 38.30 into the video you speak about AADSync being the glue between multi forest environments and when a user is on boarded AADSync will update attributes for both environments. Is this assuming GalSync is in place and there is a User in one forest and a contact in another? Therefore if we are matching in AADSync cross forest against the “mail” attribute and the User/Contact are “joined” in the metaverse. AADSync will update the targetaddress of the contact in ForestB to point to 365 if the corresponding user in ForestA is onboarded?

    Many thanks, I know you are busy. Apologies if there is a better place to ask a question like this.

    1. Hi Graham,

      sorry for the belated reply; sometimes it’s easier to email/tweet me…
      It is true that the attribute flow is the most important part of a multi-forest setup.
      When doing such a deployment with AAD Sync, you have multiple options. Which ones to choose depend on your current setup.
      You’ll notice that when adding multiple directories in AADC, you will have the option to choose how objects are matched and whether or not objects are represented more than once throughout the various forests.
      In your case, I assume the latter would be true. What AADC then will do is join the objects together in the metaverse and export it to AAD. What it will not do, is modify the on-prem objects like e.g. changing the addresses on those objects. The modification of the targetAddress is something that happens as part of the onboarding process and is being taken care of by the MRS. As such, the mailbox is converted to a MEU and the targetAddress is updated. The latter is not one of the (hybrid) write-back attributes, hence why AADC doesn’t take care of it.

      Hope this helps!

      1. That’s great, thanks Michael. This is what I was expecting.

        Always good to hear back from you and I will remember to use one of your preferred mediums to message you in future.

        All the best

  2. When an on-premise mailbox tries to access (Full access) a mailbox that is Office 365 and is prompted for credentials what credentials should be entered?

    1. The user accessing the Office 365 mailbox should enter his “Office 365” credentials. If he does not have any, he won’t be able to access the mailbox in EXO. What those credentials look like will depend on how you have setup authentication (ADFS, SSO, PTA, PHS, ….)

Leave a Reply


You are commenting using your account. Log Out /  Change )

Google photo


Twitter picture


Facebook photo


Connecting to %s
