Cloud-Only Identity Migration¶

# Identify users with on-premises mailboxes
Get-MgUser -All -Property UserPrincipalName, Mail, OnPremisesSyncEnabled,
    ProxyAddresses |
    Where-Object {
        $_.OnPremisesSyncEnabled -eq $true -and
        $_.ProxyAddresses -match "SMTP:"
    } |
    Select-Object UserPrincipalName, Mail |
    Export-Csv -Path ".\users-with-onprem-mailbox.csv" -NoTypeInformation

# Get all synchronized users
$syncedUsers = Get-MgUser -All -Property `
    UserPrincipalName, OnPremisesSyncEnabled, OnPremisesImmutableId,
    OnPremisesDomainName, OnPremisesSamAccountName |
    Where-Object { $_.OnPremisesSyncEnabled -eq $true }

Write-Host "Total synced users: $($syncedUsers.Count)"

# Categorize by conversion readiness
$readyForConversion = $syncedUsers | Where-Object {
    # Add your readiness criteria here
    # Example: users in specific OUs, departments, or locations
    $_.OnPremisesDomainName -eq "corp.contoso.com"
}

Write-Host "Ready for conversion: $($readyForConversion.Count)"

# After sync cycle processes the scope change
$user = Get-MgUser -UserId "jdoe@contoso.com" `
    -Property OnPremisesSyncEnabled, OnPremisesImmutableId,
    OnPremisesLastSyncDateTime

if ($user.OnPremisesSyncEnabled -eq $false -or $user.OnPremisesSyncEnabled -eq $null) {
    Write-Host "User is cloud-managed" -ForegroundColor Green
    Write-Host "Last sync: $($user.OnPremisesLastSyncDateTime)"
} else {
    Write-Host "User is still synchronized" -ForegroundColor Red
}

# Optional: Clear the ImmutableId to fully sever the link
# This prevents accidental re-matching if sync is re-enabled
Update-MgUser -UserId "jdoe@contoso.com" `
    -OnPremisesImmutableId ""

# Verify
$user = Get-MgUser -UserId "jdoe@contoso.com" `
    -Property OnPremisesImmutableId
Write-Host "ImmutableId: '$($user.OnPremisesImmutableId)'"
# Should be empty

# Bulk conversion script with safety checks
param(
    [string]$CsvPath = ".\conversion-candidates.csv",
    [switch]$WhatIf
)

$candidates = Import-Csv -Path $CsvPath
$results = @()

foreach ($candidate in $candidates) {
    $upn = $candidate.UserPrincipalName

    # Safety check 1: Verify user exists in Entra
    $user = Get-MgUser -UserId $upn -Property `
        OnPremisesSyncEnabled, Mail, AssignedLicenses -ErrorAction SilentlyContinue

    if (-not $user) {
        $results += [PSCustomObject]@{
            UPN = $upn; Status = "NOT_FOUND"; Action = "SKIP"
        }
        continue
    }

    # Safety check 2: Verify mailbox is in Exchange Online
    # (Requires Exchange Online PowerShell module)
    $mailbox = Get-EXOMailbox -Identity $upn -ErrorAction SilentlyContinue
    if (-not $mailbox) {
        $results += [PSCustomObject]@{
            UPN = $upn; Status = "NO_CLOUD_MAILBOX"; Action = "SKIP"
        }
        continue
    }

    # Safety check 3: Verify no active AD FS relying party dependencies
    # (Check sign-in logs for federated auth in last 30 days)
    $fedSignIns = Get-MgAuditLogSignIn -Filter `
        "userPrincipalName eq '$upn' and authenticationProtocol eq 'wsFed'" `
        -Top 1

    if ($fedSignIns) {
        $results += [PSCustomObject]@{
            UPN = $upn; Status = "ACTIVE_FEDERATION"; Action = "SKIP"
        }
        continue
    }

    # All checks passed - proceed with conversion
    if (-not $WhatIf) {
        # Move user out of sync scope in AD
        $adUser = Get-ADUser -Filter "UserPrincipalName -eq '$upn'"
        if ($adUser) {
            Move-ADObject -Identity $adUser.DistinguishedName `
                -TargetPath "OU=CloudManaged,DC=contoso,DC=com"
        }
    }

    $results += [PSCustomObject]@{
        UPN = $upn; Status = "CONVERTED"; Action = if ($WhatIf) { "WHATIF" } else { "MOVED" }
    }
}

$results | Export-Csv -Path ".\conversion-results.csv" -NoTypeInformation
$results | Group-Object Status | Format-Table Name, Count

# Convert domain from federated to managed
# WARNING: This affects ALL users in the domain immediately
# Use staged rollout to pilot before full conversion

# Check current domain authentication type
$domain = Get-MgDomain -DomainId "contoso.com"
Write-Host "Current auth type: $($domain.AuthenticationType)"

# Convert to managed (PHS)
Update-MgDomain -DomainId "contoso.com" `
    -AuthenticationType "Managed"

# Verify conversion
$domain = Get-MgDomain -DomainId "contoso.com"
Write-Host "New auth type: $($domain.AuthenticationType)"
# Should output: "Managed"

# Remove AD FS farm
# On each AD FS server:
Uninstall-WindowsFeature ADFS-Federation -IncludeManagementTools

# Remove WAP (Web Application Proxy) servers
Uninstall-WindowsFeature Web-Application-Proxy -IncludeManagementTools

# Remove DNS records
# - fs.contoso.com (A record pointing to AD FS VIP)
# - enterpriseregistration.contoso.com (CNAME for device registration)

# Remove SSL certificates from load balancer
# Remove AD FS service account from AD

# Generate application readiness report
# Requires: Entra ID sign-in logs, AD FS audit logs

# SaaS applications already using Entra SSO
$entraApps = Get-MgServicePrincipal -All |
    Where-Object { $_.AppId -ne $null -and $_.Tags -contains "WindowsAzureActiveDirectoryIntegratedApp" } |
    Select-Object DisplayName, AppId, SignInAudience

# AD FS relying parties still active
# (Run on AD FS server)
$adfsRPs = Get-AdfsRelyingPartyTrust | Select-Object Name, Identifier, Enabled

# Compare: apps in Entra vs apps still on AD FS
Write-Host "Apps in Entra SSO: $($entraApps.Count)"
Write-Host "Apps still on AD FS: $(($adfsRPs | Where-Object Enabled).Count)"

# Inventory all service accounts in AD
Get-ADUser -Filter {
    ServicePrincipalName -like "*" -or
    Description -like "*service*" -or
    PasswordNeverExpires -eq $true
} -Properties ServicePrincipalName, PasswordNeverExpires, LastLogonDate,
    Description, PasswordLastSet |
    Select-Object SamAccountName, Description, ServicePrincipalName,
    PasswordNeverExpires, PasswordLastSet, LastLogonDate |
    Export-Csv -Path ".\service-accounts-audit.csv" -NoTypeInformation

# If a cloud-only user needs to be re-synced to AD:
# 1. Move the user back into the sync scope OU
Move-ADObject -Identity "CN=John Doe,OU=CloudManaged,DC=contoso,DC=com" `
    -TargetPath "OU=Employees,DC=contoso,DC=com"

# 2. Set the ImmutableId back to the on-prem objectGUID
$onPremGuid = (Get-ADUser -Identity "jdoe" -Properties objectGUID).objectGUID
$immutableId = [System.Convert]::ToBase64String($onPremGuid.ToByteArray())
Update-MgUser -UserId "jdoe@contoso.com" -OnPremisesImmutableId $immutableId

# 3. Wait for next sync cycle (or force sync)
# Cloud Sync: automatic within minutes
# Entra Connect: Start-ADSyncSyncCycle -PolicyType Delta

# Re-federate a managed domain (emergency rollback)
# Requires AD FS farm to still be operational
New-MgDomainFederationConfiguration -DomainId "contoso.com" `
    -IssuerUri "http://fs.contoso.com/adfs/services/trust" `
    -PassiveSignInUri "https://fs.contoso.com/adfs/ls/" `
    -SigningCertificate $signingCert `
    -ActiveSignInUri "https://fs.contoso.com/adfs/services/trust/2005/usernamemixed"

# Run after each conversion wave
$convertedUsers = Import-Csv ".\conversion-results.csv" |
    Where-Object { $_.Status -eq "CONVERTED" }

foreach ($user in $convertedUsers) {
    $mgUser = Get-MgUser -UserId $user.UPN -Property `
        OnPremisesSyncEnabled, AccountEnabled, AssignedLicenses

    [PSCustomObject]@{
        UPN                  = $user.UPN
        CloudManaged         = ($mgUser.OnPremisesSyncEnabled -ne $true)
        AccountEnabled       = $mgUser.AccountEnabled
        LicensesAssigned     = ($mgUser.AssignedLicenses.Count -gt 0)
    }
} | Format-Table -AutoSize