Consolidating 2 AD's and Office 365

we looking consolidate our user accounts across 2 active directory’s , office 365. our current setup is:

internal office/lan ad: user names in format firstname.lastname@internal.company.com. sam account name in format of 3 letter company acronym domain name, followed firstname.lastname e.g. com\firstname.lastname

private cloud ad: we have private cloud hosted external vendor hosts number of servers hosting client systems. additionally, holds our company’s sharepoint 2013 portal, , other infrastructure services. has domain controller has user accounts of our internal users have accounts on our internal office lan (in addition user accounts external users needing access cloud servers). usernames in format firstname.lastname@company.com , sam account name same internal lan e.g. com\firstname.lastname . full usernames match users company email address.

office 365: we have user accounts our users in office 365 have subscription office desktop apps. user names match users email address/cloud usernames.

the end goal users have 1 account , password works across of these environments, ideally manage within office lan , sync across other environments e.g. changed password internally replicates office 365/the cloud ad. point use ibm notes/domino email long term goal migrate office 365/exchange host our email, syncing our office lan/office 365 accounts match pre-requisite sort out prior longer term migration o365.

i’ve looked lot azure ad connect tool think achieve want, i’m not entirely clear on how best approach this.

• i’ve identified change upn in ad on our internal user accounts match users email address, , hence should sync seamlessly office 365 accounts. cause problems when try access cloud servers, such via rdp or logging onto sharepoint, given usernames match have different user sids?
• for approach, whilst can set azure ad connect on our lan sync office 365, possible sync passwords o365 cloud ad e.g. password sync lan -> o365 -> cloud ad. have adfs set on our cloud infrastructure if using adfs sync 2 ads , o365 best approach i’m happy route
• or, more suitable away user accounts in cloud ad internal lan users managed in 1 ad, , these accounts are  sync’d o365? mentioned these users need setup have rdp access servers in cloud , need able access sharepoint portal connected cloud ad authentication. internal users need able access sharepoint portal , still need keep cloud ad external users permissioned sharepoint portal/some of cloud servers (but don’t want have access internal lan systems)
• my colleague looked setting ad trust between our internal lan , cloud ad idea use internal accounts on cloud servers via trust relationship, weren’t able working. not sure if because our internal lan child/sub domain of our cloud ad domain , assume it’s inherently trusted virtue of being child domain?

my current thinking need change upn of our internal ad users match email address/cloud usernames allow happily sync our internal accounts o365 work our future o365 email migration. it’s part of having 1 user name based on email address continue work our cloud servers , sharepoint portal and/or syncing internal ad users passwords cloud accounts bit of sticking point.

hope provides sufficient information on our current set , we’re trying accomplish. if able assist identifying suitable solution appreciated. again reading , apologies long post j

hi,

i don't think it's possible synchronize account passwords between ad forests, if want achieve single sign on, suggest deploy adfs.

if there specific queries regarding office 365, here dedicated office 365 forum below you:

https://community.office365.com/en-us/f

best regards,

amy

---

please remember mark replies answers if help.
if have feedback technet subscriber support, contact tnmff@microsoft.com.

Windows Server  >  Directory Services