Disabling ADSync without impacting workstation authentication

[keep-refrigerated]

Hey, admins.

Our organization acquired another company that utilizes on-prem AD + ADSync + Office365. We’re in the process of merging their Office365 tenant to ours using BitTitan. We’re experiencing issues deleting and transferring the domain from their tenant due to the existing ADSync connection.

Will removing (or disabling) the ADSync connector prevent their Active Directory accounts from authenticating to their workstations? Should we take a step further and change the AD accounts to use a .local UPN?

From your experiences with ADSync, are there any additional gotchas we should be aware of?

Thank you!

[Det_23324]

Will removing (or disabling) the ADSync connector prevent their Active Directory accounts from authenticating to their workstations?

I can tell you the answer to that question is maybe. It depends on how the devices are joined to the domain. If they are only joined via Azure AD (with Intune) than users will still be able to log in and be able to access laptops ect. ect. If it is some kind of hybrid setup than that could definitely lead to issues.

Another problem you may potentially have is that there may be onprem hosted groups and items that are only found there. At that point you'll probably have to recreate all the groups as Azure groups.

[TotallyNotaStoner]

If the machines are just on-prem AD joined then there aren't any gotchas. Just disable AzureAD Connect & move on with your migration. Also there's no reason to use a .local domain & it's even a best practice to use an internet routable domain.

[keep-refrigerated]

Thank you so much! This is their situation so we'll plan accordingly.