Create an On-Premises OLSync Service Account

Applies to: Live@edu

Topic last modified: 2011-11-11

Important:
Outlook Live Directory Sync (OLSync) is the synchronisation solution for Microsoft Live@edu customers. If you are running a cloud-based email service with Microsoft Office 365 for enterprises, you must use the Microsoft Online Services Directory Synchronisation tool to synchronise your directories.

To collect up-to-date information from the on-premises Active Directory Domain Services (AD DS) or Active Directory directory service, you need to give Outlook Live Directory Sync (OLSync) authorisation to access data and view replicated data in the directory. Here's how:

1. Create a OLSync service account to access the on-premise domains by creating a user account in the on-premises Active Directory forest.
   
2. Grant "Replicating directory changes" permissions on the OLSync service account.
   The OLSync service account that you created in step 1 must have permissions on the on-premises domains to view replicated directory changes. Perform the following steps in each domain where OLSync needs to access account data.
   
   1. Open Active Directory Users and Computers.
      
   2. On the View menu, click Advanced Features.
      
   3. In the tree view, right-click the domain node for the on-premises provisioning domain, and then click Properties.
      
   4. On the domain Properties page, select the Security tab.
      
   5. On the Security tab, click Add, and enter the alias for the OLSync service account. In the search results, select the OLSync service account. Under Permissions for <OLSync service account name>, select the Allow box that corresponds with the permission, "Replicating directory changes."
      
   6. Click Apply and then click OK.
      
3. (Optional) If you have configured OLSync to merge and copy the X500 addresses from Outlook Live recipient objects to the corresponding recipient objects in your on-premises Active Directory, you must add the OLSync service account to the Domain Administrators security group in each domain where OLSync needs to access user data. For more information about how to copy X500 addresses, see Parameters for the OLSync Hosted Management Agent.