Microsoft Online - Troubleshooting ADFS Issues

This is a brief guide which primarily has commands used to resolve issues with AD Connect/ADFS relating to their source anchor to save having to research and find these.

This is for the error within Atria of "Object is not set to an instance of an Object" or "Source Anchor is Invalid".

This is due to a mismatch in AD and O365 of the source anchors of the user. I am unsure how this happens without manual intervention, but I believe it to be an issue with users being deleted from AD, then O365, then recreated, but not federated to begin with. This also could have issues relating to AD Connect.

Below are the commands needed to troubelshoot.

1. Identify if the source anchors are invalid. This has two parts to identify O365 & AD

A) Get the Source Anchor from AD

$UserSamAccount = "b.williams_crc"

$User = Get-ADuser $UserSamAccount -Properties ObjectGUID

$ImmutableID = [system.convert]::ToBase64String(([GUID]($User.ObjectGUID)).tobytearray())

Write-Host "ImmutableID for user $UserSamAccount is:" -ForegroundColor Cyan $ImmutableID

B) Get the Source Anchor from O365

$UserO365Upn = Get-Msoluser -UserPrincipalName "b.williams@atria.local" | Select ImmutableID

$ImmutableID = [system.convert]::FromBase64String(([GUID]($UserO365Upn.ObjectGUID)).tobytearray())

Write-Host "ImmutableID for user $UserO365Upn is:" -ForegroundColor Cyan $ImmutableID

Compare these two values, if they do not match - Continue, otherwise this whole KB is useless!

To reset an immutable ID. We need to make the user "Mutable". As the user is expected to be connected and expect the changes from the ADFS server, it currently cannot because it can't find the user, as the Source Anchor is incorrect on each end.

So - We need to convert the user to a mutable user in O365 and make this match. We do this primarily because we believe that Active Directory is the source of truth in the situation of users consuming ADFS. 

Please note - This temporarily will break the user in O365! We will be Changing the users UPN and O365 password for this. Once ADFS is Re-enabled, their previous password and UPN will start working again. This is an expected 30 second outage for the user.

Run the below commands to do the following

1. Converts the users O365 UPN to .onmicrosoft from .{customerdomain}.{postfix}

2. Sets the source anchor to match active directory
3. Converts the user back to federated by putting them back to their previous domain.

$UserSamAccount = "b.williams_crc"
$MicrosoftUPN = "b.williams@atria.local"
$OnmicrosoftTempUPN = "b.williams@atria.onmicrosoft.com"

#Get User from AD and their ImmutableID

$User = Get-ADuser $UserSamAccount -Properties ObjectGUID

$ImmutableID = [system.convert]::ToBase64String(([GUID]($User.ObjectGUID)).tobytearray())

Write-Host "ImmutableID for user $UserSamAccount is:" -ForegroundColor Cyan $ImmutableID

#Set the Immutable ID to match AD retrieved above

Set-MsolUserPrincipalName -UserPrincipalName $MicrosoftUPN -NewUserPrincipalName $OnmicrosoftTempUPN


Set-Msoluser -UserPrincipalName $OnmicrosoftTempUPN -ImmutableID $ImmutableID

Set-MsolUserPrincipalName -UserPrincipalName $OnmicrosoftTempUPN -NewUserPrincipalName $MicrosoftUPN

#Get Immutable ID back from O365

$UserO365Upn = Get-Msoluser -UserPrincipalName $MicrosoftUPN | Select ImmutableID

$ImmutableID = [system.convert]::FromBase64String(([GUID]($UserO365Upn.ObjectGUID)).tobytearray())

Write-Host "ImmutableID for user $UserO365Upn is:" -ForegroundColor Cyan $ImmutableID

Now, test reprovisioning the user and it should now function as intended!

• Related Articles

• Microsoft Online Service Planning

  Overview The Microsoft Online Service for Atria allows Customers and the service desk to manage tenants, licenses, users and features of Office 365 – with no access to the 365 admin portal. It reduces your risk, while still being able to effectively ...

• Microsoft Online Service Provisioning

  Objective This article provides a guide to configuring and provisioning the Microsoft Online Service within the Atria Platform. Before you Start After setting up the connection to Partner Center, update the service' customer plan- Service Deployments ...

• Microsoft Online Service Deployment

  Objective This article provides a guide to installing the Microsoft Online (MSOL) service into the Atria Platform. Web Service and Schema Installation The first step for the deployment of any new Service is to install the Web Service (if required) ...

• Microsoft Online - How to configure your Customer plan

  Overview The Microsoft Online service within Atria has been designed from the Ground Up with Customization and flexibility in mind. This means, that it can likely cater with most configuration scenarios you may come across with Microsoft Online ...

• Microsoft Online Group Management in Atria

  Introduction to Group Management Groups are a fundamental feature used to control access and make information sharing easier.  In the Microsoft 365 platform, there are four core group types, all of which have a core component in Azure AD.  Many ...