A lot of customers have had questions about user photos. Why are my user photos not syncing to O365? The changes replicate in on premise AD, but why can my cloud users not see the changes? Well, there is an answer for that…
There has been a significant change in how user photos are presented with newer Microsoft services which includes O365. Up until Lync 2010, user photos would use the Thumbnailphoto attribute in Active Directory to sync user GAL photos. In Lync 2013, Exchange Online and Sharepoint Online user photos are stored on the root of the user mailbox. This change was implemented for several reasons, including allowing the ability to allow high resolution photos. In short, the photos are essentially stored in two places.
In Office 365 there are 3 Active Directory systems, Azure AD (the portal) Exchange Online AD(EXO) and SharePoint Online AD (SPO). When you sync a user into Office 365, you sync uploads to Azure AD. From there the user will sync to EXO and SPO accordingly based on licenses assigned. For the user photo attribute Office 365 stores that photo at the root of the EXO mailbox. So for picture sync to work at a user is required to have a EXO license and mailbox. From there the picture will be synched into SPO.
Now SharePoint needs to create 3 thumbnails (S,M,L) to be used in various areas of the product based on photo size requirements. These photos are created and stored on the My Site Host site collection. In order for these files to be created, users must navigate to the About Me page. So even if the picture sync process between Exchange Online and SharePoint Online has completed successfully, the photo will not display in SharePoint until the thumbnail photos have been created. It is also good to note in some cases it may take up to 72 hours before the user photo may show up in Sharepoint Online.
Going forward, for Hybrid Deployments, I advise to set the users photos in the cloud. You can expect the photos to sync to O365 only 1 time from on-premise AD via the thumbnail attribute, after that there is no guarantee the photos will sync. It is best to use the Set-Userphoto cmdlet up update the O365 object. Updating the thumbnail photo on premise and syncing the changes to O365 will update on premise, however EXO does not look on premise at that attribute for changes again.
In order to get the user photos in Exchange Online to work, we will need to store the users photo in the root of the Exchange Online Mailbox. The best way to accomplish this is by using the Set-Userphoto cmdlet like below.
Set-UserPhoto “Paul Cannon” –PictureData ([System.IO.File]::ReadAllBytes(“C:\Users\Administrator\Desktop\PaulCannon.jpg”))
If you are having issues with a user photo to need to reset it, It is best to use the Remove-Userphoto, then Set-Userphoto cmdlet again.
If you wish to prevent end users from having the ability to change their user photos it is best to do this via a User Role Assignment Policy in your exchange Admin Center. Uncheck the option in the default role assignment policy (Or other policy applied to your users), for “My PersonalInformation”. It is recommended to remove the ability in Exchange, because doing so in Sharepoint will cause replication issues when it tries to sync to EXO.
Uploading photos using the Set-Userphoto cmdlet, I recommend using this cmdlet below to create your session. The difference is using the “Proxymethod=RPS”. Using this proxy method, you can upload larger files up to 4MB. For testing purposes I have uploaded a file as large as 4MB. Generally Microsoft recommends keeping the file size under 500KB, because the bigger the file the more space it takes, and the longer it takes to upload.
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/?proxyMethod=RPS -Credential (Get-Credential) -Authentication Basic -AllowRedirection
If you are still having issues syncing your user photos, I advise to open up a case with Microsoft’s Exchange Online team. Good Luck!!