With Office 365 being available at the end of this month (28 June 2011), I have been looking at the impact it may have on an on-premises Active Directory and the issues that must be resolved in order for it to fully integrate with Office 365.

Single Label Domains:

Singles Label Domains (SLD’s) are not supported (e.g. markparris.co.uk or markparris.net are, markparris. is not). Anyone with an SLD will have to migrate to a new forest to utilise Office 365.  See Microsoft Online Services compatibility with single-label domains, with disjoint namespaces, and with discontiguous namespaces

Forest Functional Level:

As far as I can ascertain the minimum supported Forest Functional Level should be Windows Server 2003 FFL (Level 2).  Even though DirSync and AD-FS support alternative FFL’s, the Microsoft Office 365 Beta Deployment Guide for Enterprises states this FFL level is required for Exchange 2010 SP1 hybrid mode coexistence and this is the lowest common denominator that Exchange 2010 SP1, DirSync and AD-FS all support.  If you don’t want to run Exchange 2010 SP1 in hybrid mode coexistence, then a lower FFL may be suitable. 

Email me at mark@parris.co.uk

Active Directory Schema:

If the organisation has a requirement for deploying Exchange hybrid mode coexistence, then the Exchange Server 2010 SP1 Schema will need to be deployed. In a global environment, that perhaps still has 32bit domain controllers with an NTDS.DIT greater than 4GB, then this schema extension may require some thought and planning, due to the additional load it may place on your DC’s.

Summary of Exchange Online Simple Coexistence and Exchange Hybrid Mode Coexistence Capabilities

Email me at mark@parris.co.uk

Number of Forests:

Office 365 will initially only support single sign on from a single forest. This may change moving forward, but if it does not then a forest rationalisation project may need to instigated. This could be a huge piece of work.

Domain Name:

To utilise AD-FS and single sign-on, the forest name or more specifically the UPN of the forest must be Internet routable. See: https://markparris.co.uk/2011/03/08/active-directory-local-domain-design-and-office-365 This could be a huge piece of work.

Active Directory Recycle Bin

If the Active Directory Recycle Bin has been enabled then this may impact your total object count quota for Directory Synchronization (in the beta this was 10000 objects). If the Active Directory Recycle Bin has not been enabled, this may be a factor in waiting before enabling it as it is an irreversible action.

Active Directory Cleanup:

Remove duplicate proxyAddress and userPrincipalName attributes.

Update blank and invalid userPrincipalName attributes with a valid userPrincipalName.

Ensure the attributes meet the requirements and remove invalid or questionable characters as detailed:


Maximum number of characters: 20

Invalid Active Directory characters: !#\$%\^&\{\}\\{`~"",\\/\[\]:@<>\+=;\?\* If a user has an invalid sAMAccountName but a valid userPrincipalName, the user account is created in Office 365.

If both the sAMAccountName and userPrincipalName are invalid, the on-premises Active Directory userPrincipalName must be updated.


Maximum number of characters: 64

Questionable characters: ?@\+

sn (surname) Maximum number of characters: 64

Questionable characters: ?@\+


Maximum number of characters: 256

Questionable characters: \?@\+


Maximum number of characters: 256

Invalid characters: [! #$ %&*+ / = ? ^ ` { }]

Duplicate values: The mail attribute cannot contain any duplicate values.

mailNickname Maximum number of characters: 64

Invalid characters: ""\\\[\]:><;


Maximum number of characters: 256

Invalid characters: \)\(;><\]\[\\,

userPrincipalName Maximum number of characters for username: 64

Maximum number of characters for domain name: 256

Invalid characters: }{ # ‗ $ % ~* + ) ( > < ! / \ = ? `

& character: Automatically changed to underscore

^ character: The value is automatically removed.

(_) character: This remains the same.

Duplicate proxies will be emailed as an error before any notification errors.

Additional requirements for a valid userPrincipalName:

@ character is required in each userPrincipalName value.

@ character cannot be first character in each userPrincipalName value.

Username cannot end with a period (.) an ampersand (&) a space ( ), or at sign (@)

Username cannot have a space ( ).

Routable domains must be used (.local or .internal cannot be used)

Unicode is converted to underscore characters.

userPrincipalName may not contain any duplicate values in the forest.


Mail-enabled character check: All mail-enabled groups must follow the pattern of *@*.

Contacts Mail-enabled character check: All mail-enabled contacts must follow the pattern of *@*.


Populate the following Username attributes:

First Name

Last Name

Display Name

For optimal use of the Global Address List (GAL), populate the following GAL attributes:

Job Title



Office Phone

Mobile Phone

Fax Number

Street Address


State or Province

Zip or Postal Code

Country or Region

Note:  This page will be regularly updated as my experience with Office 365 grows.


  1. Hi Mark,

    interesting article!
    Having a routable internal domain name sucks, as a lot of us have been using .local as the domain extension in the past…

    Cheers – Erik
    eXcellence & Difference

    1. True, but this can be readily resolved with a routable UPN and does not require a full Active Directory Migration, caused by say a Single Label Domain namespace.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.