Convert a Federated Domain in Azure AD to Managed and Use Password Sync – Step by Step



AskPFEPlat is in the process of a transformation to the new Core Infrastructure and Security TechCommunity, and will be moving by the end of March 2019 to our new home at (hosted at Please bear with us while we are still under construction!

We will continue bringing you the same great content, from the same great contributors, on our new platform. Until then, you can access our new content on either as you do today, or at our new site Please feel free to update your bookmarks accordingly!

Why are we doing this? Simple really; we are looking to expand our team internally in order to provide you even more great content, as well as take on a more proactive role in the future with our readers (more to come on that later)! Since our team encompasses many more roles than Premier Field Engineers these days, we felt it was also time we reflected that initial expansion.

If you have never visited the TechCommunity site, it can be found at On the TechCommunity site, you will find numerous technical communities across many topics, which include discussion areas, along with blog content.

NOTE: In addition to the AskPFEPlat-to-Core Infrastructure and Security transformation, Premier Field Engineers from all technology areas will be working together to expand the TechCommunity site even further, joining together in the technology agnostic Premier Field Engineering TechCommunity (along with Core Infrastructure and Security), which can be found at!

As always, thank you for continuing to read the Core Infrastructure and Security (AskPFEPlat) blog, and we look forward to providing you more great content well into the future!


Hi all! I am Bill Kral, a Microsoft Premier Field Engineer, here to give you the steps to convert your on-premise Federated domain to a Managed domain in your Azure AD tenant. In this case, we will also be using your on-premise passwords that will be sync’d with Azure AD Connect.

There are many ways to allow you to logon to your Azure AD account using your on-premise passwords. You can use ADFS, Azure AD Connect Password Sync from your on-premise accounts or just assign passwords to your Azure account. In addition, Azure AD Connect Pass-Through Authentication is currently in preview, for yet another option for logging on and authenticating.

Recently, one of my customers wanted to move from ADFS to Azure AD passwords sync’d from their on-premise domain to logon. So, we’ll discuss that here.

Let’s set the stage so you can follow along:

The on-premise Active Directory Domain in this case is US.BKRALJR.INFO

The AzureAD tenant is

We are using Azure AD Connect for directory synchronization (Password Sync currently not enabled)

We are using ADFS with US.BKRALJR.INFO Federated with the Azure AD Tenant

  1. First, insure your Azure AD Connect Sync ID has “Replicate Directory Changes” and “Replicate Directory Changes All” permissions in AD (For Password Sync to function properly). If you did not set this up initially, you will have to do this prior to configuring Password Sync in your Azure AD Connect.

  1. You can check your Azure AD Connect servers Security log that should show AAD logon to AAD Sync account every 30 minutes (Event 4648) for regular sync. When you enable Password Sync, this occurs every 2-3 minutes.
  1. On the Azure AD Connect server, run CheckPWSync.ps1 to see if Password Sync is enabled

    Note: Here is a script I came across to accomplish this. Copy this script text and save to your Azure AD Connect server and name the file with a CheckPWSync.ps1.

    —————————————- Begin Copy After this Line ————————————————

    Import-Module ADSync
    $connectors = Get-ADSyncConnector
    $aadConnectors = $connectors | Where-Object {$_.SubType -eq “Windows Azure Active Directory (Microsoft)”}
    $adConnectors = $connectors | Where-Object {$_.ConnectorTypeName -eq “AD”}
    if ($aadConnectors -ne $null -and $adConnectors -ne $null)
    if ($aadConnectors.Count -eq 1)
    $features = Get-ADSyncAADCompanyFeature -ConnectorName $aadConnectors[0].Name
    Write-Host “Password sync feature enabled in your Azure AD directory: ” $features.PasswordHashSync
    foreach ($adConnector in $adConnectors)
    Write-Host “Password sync channel status BEGIN ——————————————————- ”
    Get-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector.Name
    $pingEvents =
    Get-EventLog -LogName “Application” -Source “Directory Synchronization” -InstanceId 654 -After (Get-Date).AddHours(-3) |
    Where-Object { $_.Message.ToUpperInvariant().Contains($adConnector.Identifier.ToString(“D”).ToUpperInvariant()) } |
    Sort-Object { $_.Time } -Descending
    if ($pingEvents -ne $null)
    Write-Host “Latest heart beat event (within last 3 hours). Time ” $pingEvents[0].TimeWritten
    Write-Warning “No ping event found within last 3 hours.”
    Write-Host “Password sync channel status END ——————————————————- ”
    Write-Warning “More than one Azure AD Connectors found. Please update the script to use the appropriate Connector.”
    if ($aadConnectors -eq $null)
    Write-Warning “No Azure AD Connector was found.”
    if ($adConnectors -eq $null)
    Write-Warning “No AD DS Connector was found.”

    —————————————- End Copy Prior to this Line ——————————————-

    As you can see, mine is currently disabled.

    1. Setup Password Sync via Azure AD Connect (Options)
      1. Open the Azure AD Connect wizard on the AD Connect Server

      1. Select “Customize synchronization options” and click “Next”

      1. Enter your AAD Admin account/ Password and click “Next”

      1. If you are only enabling Password hash synchronization, click “Next” until you arrive at the Optional features window leaving your original settings unchanged
      2. On the “Optional features” window, select “Password hash synchronization” and click “Next”

        Note: If you have previously selected other options, leave those as intended

      3. Click “Install” to reconfigure your service

    2. Restart the Microsoft Azure AD Sync service
    3. Force a Full Sync in Azure AD Connect in a powershell console by running the commands below
      1. Import-module ADSync
      2. Start-ADSyncSyncCycle -PolicyType Initial
    4. On your Azure AD Connect server, run CheckPWSync.ps1 to see if Password Sync is enabled

  1. On your Azure AD Connect server, run TriggerFullPWSync.ps1 to trigger full password sync (Disables / enables)

Note: Here is a script I came across to accomplish this. Copy this script text and save to your AD Connect server and name the file TriggerFullPWSync.ps1. Update the $adConnector and $aadConnector variables with case sensitive names from the connector names you have in your Synchronization Service Tool.

—————————————- Begin Copy After this Line ————————————————

# Run script on AD Connect Server to force a full synchronization of your on prem users password with Azure AD
# Change to your on prem domain name to match your connector name in AD Connect
# Change aadtenant to your AAD tenant to match your connector name in AD Connect
$adConnector = “”
$aadConnector = “ – AAD”
Import-Module adsync
$c = Get-ADSyncConnector -Name $adConnector
$p = New-Object Microsoft.IdentityManagement.PowerShell.ObjectModel.ConfigurationParameter “Microsoft.Synchronize.ForceFullPasswordSync”, String, ConnectorGlobal, $null, $null, $null
$p.Value = 1
$c = Add-ADSyncConnector -Connector $c
Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $false
Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $true

—————————————- End Copy Prior to this Line ——————————————-

  1. Now, we can go to the Primary ADFS Server and convert your domain from Federated to Managed
    1. On the Primary ADFS Server, import he MSOnline Module

      Import-Module MSOnline

    2. Connect to your AAD Tenant

      Connect-MSOLService -> Enter AAD credentials on the pop-up

      Note: You can also run from another server, but then need to set the context of what ADFS server you connect to. Ie: Set-MsolADFSContext -Computer <AD FS servername>

      I find it easier to do the Azure AD Connect tasks on the Azure AD Connect server and the ADFS/Federation tasks on the primary ADFS server.

    3. Confirm the domain you are converting is listed as Federated by using the command below

Get-MsolDomain -Domainname domain -> inserting the domain name you are converting. Ie: Get-MsolDomain -Domainname

  • Convert Domain to managed and remove Relying Party Trust from Federation Service. Now, you may convert users as opposed to the entire domain, but we will focus on a complete conversion away from a Federated domain to a Managed domain using on prem sourced passwords.

    Convert-MsoldomainToStandard -Domainname domain -SkipUserConversion $false -PasswordFile c:\domain_userpasswords.txt -> inserting the domain name you are converting and a password file name of your choice that does not currently exist. Ie: Convert-MsoldomainToStandard -Domainname -SkipUserConversion $false -PasswordFile c:\usbkraljrinfo_userpasswords.txt


Here is where the, so called, “fun” begins. There is no status bar indicating how far along the process is, or what is actually happening here. Under the covers, the process is analyzing EVERY account on your on prem domain, whether or not it has actually ever been sync’d to Azure AD. If an account had actually been selected to sync to Azure AD, it is converted and assigning a random password. That is what that password file is for… Also, since we have enabled Password hash synchronization, those passwords will eventually be overwritten.

What does all this mean to you? You must be patient!!! For an idea of how long this process takes, I went through this process with a customer who had a 10k user domain and it took almost 2 hours before we got the “Successfully updated” message. Therefore, you can expect an approximate processing rate of 5k users per hour, although other factors should be considered, such as bandwidth, network or system performance. That doesn’t count the eventual password sync from the on prem accounts and AAD reverting from “Federated” to “Not Planned” or “Not Configured” in the Azure Portal. So, just because it looks done, doesn’t mean it is done.

  1. On the Azure AD Connect server, run TriggerFullPWSync.ps1 to trigger full password sync

  1. On the ADFS server, confirm the domain you have converted is listed as “Managed”

    Get-MsolDomain -Domainname domain -> inserting the domain name you are converting. Ie: Get-MsolDomain -Domainname

  1. Check the Single Sign-On status in the Azure Portal. It should not be listed as “Federated” anymore

  1. Logon to “” with a sync’d Azure AD account. There should now be no redirect to ADFS and your on prem password should be functional…… Assuming you were patient enough to let everything finish!!!

  1. The Azure AD Connect servers Security log should show AAD logon to AAD Sync account every 2 minutes (Event 4648)

That should do it!!! Bottom line… be patient… I will also be addressing moving from a Managed domain to a Federated domain in my next post, as well as setting up the new Pass-Through Authentication (PTA) capabilities that are being introduced into Azure AD Connect in future posts. Thanks for reading!!!