Step 1: Review the AD Connector best practices. Required:. All users you'd like to sync from Active Directory must be active users in a single AD domain.

1. Active Directory Sync Status

Active Directory Sync Status

PowerShell 4.0 or higher. Windows Server 2008 (or later). Remote Server Administration Tools Recommended:. Create a single group called 'Dropbox' that contains all the members you’d like to provision. You can place both users and groups within the Dropbox group. Install the AD Connector on a server with read-only access (the AD Connector only syncs changes that originate from AD). Upgrading from previous versions of the AD Connector: A simple installation usually updates correctly when upgrading from version 2.0.1 to version 2.0.2.

However, when upgrading between major versions (from 1.0 to 2.0), uninstall the current version before updating to the new one. For the current release of the AD Connector, we recommend syncing no more than 10,000 users from Active Directory. Check with your Dropbox Customer Success team if you’d like to use the AD Connector with more than 10,000 users. Step 2: Download the AD Connector Microsoft Installer (MSI). Step 3: Install the AD Connector.

Locate and run the Dropbox-AD-Connector.msi installer. Click Next to continue through the install wizard. Check the box to accept the terms, and click Next.

Click Next to install to the default path. Click Install, and then choose Yes if User Account Control (UAC) prompts you. Getting Started is checked by default—if you already have this guide open, uncheck it. Select Finish to complete the installation. Step 4: Set up the Configure AD Connector tool. There are five steps in the process of completing the AD Connector configuration:. Setup.

Active Directory users sync. Active Directory groups sync. Email notifications. To complete configuration, carefully follow each step: Setup. Locate and open the Configure AD Connector shortcut on your desktop. Click Get OAuth2 Token to connect to the team admin of your Dropbox Business team. If needed, sign in to Dropbox as an Admin of the Dropbox Business team.

If needed, approve the AD Connector app permissions. Copy the token. Paste the copied token into the OAuth 2 DfB Token field. If you'd like to run setup tests, select the Simulation Mode checkbox. Note: In Simulation Mode, no changes are made to your Dropbox Business team. Active Directory sync users. Select the Active Directory group you'd like to sync with your Dropbox Business team.

It's easiest to create an Active Directory group called 'Dropbox'. Check that Email Attribute is set to Email Address. Check Manage existing users to sync changes to users that were manually created through. Active Directory sync groups. Choose whether you'd like to sync groups to your Dropbox Business team (syncing groups is optional).

To sync groups, select whether you'd like to use the same group you chose to sync individual users. If you chose to use a different group to sync groups, select the name of the group. Log.

If you wish to provide a different path for the log file, click Change. Note: If you don't provide a different file path, the log is saved to the default location: C: ProgramData Dropbox AD Connector dbadconnector.log Email notifications. If you’d like to receive email notifications, click Settings. Note: Use port 587 or port 25 (unencrypted); port 465 is not currently supported.

After finishing each section, use Test Connection to verify that the configuration is correct. Click OK when finished configuring the email options. Finish. Click Save to save all configuration settings. Step 5: Perform a test run with Run AD Connector, and verify that it's working successfully. Locate the Run AD Connector shortcut on the desktop.

Right-click the Run AD Connector tool and Run as Administrator. Review the results to ensure that the expected users are listed.

If yes, reopen the Config AD Connector tool and uncheck Simulation Mode. Use the Run AD Connector tool to sync new members to your Dropbox Business team. Step 6: Locate the scheduled task, and enable it to run. Browse to Program Files Dropbox AD Connector Helpers. Right-click on the file AD-Connector-CreateTask.bat and Run as Administrator.

Open the Task Scheduler application for Windows Server. Open the Dropbox Tasks folder. Right-click on the Dropbox AD Connector task, and choose Enable.

Note: If you can't find this task, right-click the Task Scheduler Library and choose Refresh. Right-click on the task, and choose Run.

Ensure that the test ran successfully: locate and review the AD Connector sync log. Verify that invites were sent to team members: Review the. Notes on creating scheduled tasks:. By default, this task is set to run once a day at 2:00 am (local time). You can increase the frequency of this task, but we recommend running it no more than once every three hours.

Ensure that scheduled tasks don't interrupt each other: select Do not start a new instance in the Settings tab. Advanced setup and troubleshooting (Optional) Groups and the Dropbox Active Directory Connector Groups in Active Directory sync with Dropbox, but Dropbox groups don’t sync with AD. Changes from Dropbox Business do not sync back to Active Directory. Deleting a group from Dropbox Business does not delete the group from Active Directory. To delete a group in both Dropbox Business and Active Directory, you’ll need to:. Remove all members from the sync group in Active Directory. Remove the sync group from the configuration step Keep in mind:.

If you have multiple groups with the same name between Active Directory and Dropbox Business, group sync fails. An error is also logged.

You cannot nest groups inside other groups in Dropbox. Groups cannot have multiple layers in Dropbox Business.

Each group is flat and does not contain other groups. What happens when you select a single group to sync both your users and groups?

For groups with users that aren't in the sync group, the group fails to sync to Dropbox Business. How do groups sync to Dropbox if I use a different Active Directory group to sync user accounts? All users in the user sync group are synced. Any groups in the user sync group are ignored. Users placed in the group sync group are ignored unless also in the user group. Groups placed in the user sync group are ignored unless also in the group sync group.

Account transfers and the Dropbox Active Directory Connector The AD Connector does not support the automatic transfer of an account to a different team member. However, deleted accounts (and any associated files) are held in the Admin Console. These accounts can then be transferred or permanently deleted from the Dropbox admin console. Team admins can. Remote wipe and the Dropbox Active Directory Connector When suspending or deleting users with the AD Connector, all devices are automatically remotely wiped. Use the Admin Console to remove a user or device without remotely wiping all content. What should I do if the Active Directory Connector sync failed?

Each time the AD Connector runs, an exit code is added to the end of the log file. This code attributes the reason for the failure, and/or determines what part of the process failed.

This table provides examples of reasons a failure could occur. Note: The AD Connector logs a 0 when the run completes successfully Code Reason for failure How to correct this error -1 Powershell version not supported. Upgrade to Powershell versions 4, 5, or higher -10 Unable to read configuration file. If you manually edited the config file, there may a file error that our script cannot read.

Set up directory synchronization for Office 365. 8/21/2018. 5 minutes to read. Contributors.

In this article Office 365 uses the cloud-based user identity management service Azure Active Directory to manage users. You can also integrate your on-premises Active Directory with Azure AD by synchronizing your on-premises environment with Office 365. Once you set up synchronization you can decide to have their user authentication take place within Azure AD or within your on-premises directory. Office 365 directory synchronization You can either use synchronized identity or federated identity between your on-premises organization and Office 365. With synchronized identity, you manage your users on-premises, and they are authenticated by Azure AD when they use the same password in the cloud as on-premises. This is the most common directory synchronization scenario. Pass-through authentication or Federated identity, allows you to manage your users on-premises and they are authenticated by your on-premises directory.

Federated identity requires additional configuration and enables your users to only sign in once. For details, read.

Want to upgrade from Windows Azure Active Directory sync (DirSync) to Azure Active Directory Connect? If you are currently using DirSync and want to upgrade, head over to for. Prerequisites for Azure AD Connect You get a free subscription to Azure AD with your Office 365 subscription. When you set up directory synchronization, you will install Azure Active Directory Connect on one of your on-premises servers. For Office 365 you will need to:. Verify your on-premises domain (the procedure will guide you through this). Have permissions for your Office 365 tenant and on-premises Active Directory.

For your on-premises server on which you install Azure AD Connect you will need the following software: Server OS Other software Windows Server 2012 R2 - PowerShell is installed by default, no action is required. Net 4.5.1 and later releases are offered through Windows Update. Make sure you have installed the latest updates to Windows Server in the Control Panel. Windows Server 2008 R2 with Service Pack 1 (SP1) or Windows Server 2012 - The latest version of PowerShell is available in Windows Management Framework 4.0. Search for it on.Net 4.5.1 and later releases are available on. Windows Server 2008 - The latest supported version of PowerShell is available in Windows Management Framework 3.0, available on.Net 4.5.1 and later releases are available on. Note If you're using Azure Active Directory DirSync, the maximum number of distribution group members that you can synchronize from your on-premises Active Directory to Azure Active Directory is 15,000.

For Azure AD Connect, that number is 50,000. To more carefully review hardware, software, account and permissions requirements, SSL certificate requirements, and object limits for Azure AD Connect, read. You can also review the Azure AD Connect to see what is included and fixed in each release. To set up directory synchronization.

Sign in to the Office 365 admin center and choose Users Active Users on the left navigation. In the Office 365 admin center, on the Active users page, choose.

More. Directory synchronization. On the. Is directory sync right for you?. page, the two first choices of 1-10, and 11-50 result in 'Based on the size of your organization, we recommend that you create and manage users in the cloud. Using directory synchronization will make your setup more complex. Go to Active users to add your users.'

. You can still, however, continue setting up directory synchronization by choosing Continue here on the bottom of the page. If you select the two latter choices, 51-250 or 251 or greater, the synchronization setup will recommend directory synchronization. Choose Next to continue. On the Sync your local directory with the cloud, read the information, and if you want more information, choose the learn more link that goes to:, and then choose Next.

On the Let's check your directory page, review the requirements for automatically checking your directory. If you meet the requirements, choose Next Start scan. If you can't meet the requirements you can still continue by choosing continue manually. If you select to scan your directories, choose Start scan on the Evaluating directory synchronization setup page. Follow the instructions to download and run the scan. Once the scan is complete, return to the setup wizard, and choose Next to see your scan results.

Verify your domains as instructed on the Verify Ownership of your domains page. For detailed instructions, see. Important After you have added a TXT record to verify you own your domain, do not go to the next step of adding users in the domains wizard. The directory synchronization will add users for you. Return to the Office 365 Setup page and choose Refresh. On the Your domains are ready page, choose Next. On the Clean up your environment page, optionally follow the instructions to download IDFix to check your Active Directory.

Choose Next to continue. On the. Run Azure Active Directory Connect. page, choose Download to install Azure AD Connect wizard. Note At this point you will be in the Azure AD Connect wizard.

Make sure you leave the directory synchronization wizard page you were last on open in your browser, so you can return to it after the Azure AD Connect steps are done. After Azure AD Connect wizard has installed it will automatically open. You can also open it from your desktop, the default install site.

Follow the wizard instructions depending on your scenario:. For directory synchronization with password hash synchronization, use. For multiple forests, pass-through authentication, federated identity and SSO options, use. Select Customize on the Express Settings page to use these options. After the Azure AD Connect wizard is done, return to the Office 365 Setup wizard, and follow the instructions on the Make sure sync worked as expected page. Choose Next to continue. Read the instructions on the.

Activate users. page and then choose Next. Choose Finish on the You're all setup page.

Assign licences to synchronized users After you have synchronized your users to Office 365, they are created but you need to assign licenses to them so they can use Office 365 features, such as mail. For instructions, see. Finish setting up domains Follow the steps in to finish setting up your domains.