Active Directory and Distribution Groups with Office 365

active-directorygroupsmicrosoft-office-365powershellscripting

I have a O365 with Exchange, and a local AD.

I want to manage distribution groups and distribution groups members via PS scripts (that will run by scheduled task), that look users' AD attributes (don't know which attributes right now).

The script will be hosted in the local AD.

So If I want to manage distribution groups (DG), I can use PS to connect to my O365, and then manage DG. But I don't know If i'll be able to check AD users' attributes from a PS Session on O365 ?

So I'm wondering what is the best way to handle this.

Can I just manage DG from the AD without the need to connect to O365 Exchange ?

This means that I create AD Group, enable mail, and put users I want, in. Then, the replication will synchronize AD Group with O365 (with DirSync if I'm right).

Do these groups will be see as "Distribution Group" in O365 Exchange view ? And people will be able to email these DG ?
Or Do I have to do some stuff in O365 Exchange side ?

To be clear, question is : Can I create a DG from local AD server in PS (Create-Group), by setting the mail address (and others attributes I dont now yet), and then Exchange will see it as a good DG and I'll be able to send email to it ?

Feel free to ask for more details if needed. hope I'm clear enough.

Best Answer

This means that I create AD Group, enable mail, and put users I want, in. Then, the replication will synchronize AD Group with O365 (with DirSync if I'm right).

That's pretty much it, yes. There's plenty of resources out there covering the installation and setup of DirSync, and you may refer to this table of attributes that are synced from on-premises AD to Office 365. You can manually trigger a sync of dirsync by opening DirSyncConfigShell and running Start-OnlineCoexistenceSync

So you can create a DG on-premises, set the Mail and ProxyAddresses attributes and then DirSync will create a synchronised DG in O365. This group will show up in the ECP > Groups, the same as a group which is created online. However, since the group was created on-premises it must be managed on-premises (as the sync is one-way). Trying to alter the attributes online will give you:

The action 'Set-DistributionGroup', 'PrimarySmtpAddress', can't be performed on the object 'IT-team' because the object is being synchronized from your on-premises organization.

There is no need to mail-enable the DG, as DGs are mail-enabled by default at creation.

To be clear, question is : Can I create a DG from local AD server in PS (Create-Group), by setting the mail address (and others attributes I dont now yet), and then Exchange will see it as a good DG and I'll be able to send email to it ?

Broadly yes. You'll have to use a PS cmdlet that actually exists though, ie New-ADGroup and specify -GroupCategory Distribution

Related Topic