Home  |  Service Status  |  Team Blog  |  Forums
Outlook Web App > For Exchange Online Administrators > Outlook Live for Live@edu > Implement Outlook Live Directory Sync for Live@edu > Deploy Outlook Live Directory Sync for Live@edu >

Create an OLSync Service Account in Outlook Live

Applies to: Live@edu

Topic last modified: 2011-12-02

Dd490638.important(en-GB,EXCHSRVCS.140).gifImportant:
Outlook Live Directory Sync (OLSync) is the synchronisation solution for Microsoft Live@edu customers. If you are running a cloud-based email service with Microsoft Office 365 for enterprises, you must use the Microsoft Online Services Directory Synchronisation tool to synchronise your directories.

When you run Outlook Live Directory Sync (OLSync), Forefront Identity Manager (FIM) 2010 or Microsoft Identity Lifecycle Manager (ILM) 2007 creates mail users, external contacts, groups and mailboxes in your Outlook Live domain. To create these accounts, FIM 2010 or ILM 2007 has to use a Windows Live account that has been granted specific permissions in your Outlook Live organisation. The Windows Live account becomes the OLSync service account.

This topic explains how to create the service account, how to apply the appropriate permissions to that service account and how to test the configuration.

1. Create a service account in the Outlook Live organisation

The account you create in this step is a regular Windows Live account with an Outlook Live mailbox. It's easy to create:

  • Sign in to the Exchange Control Panel for the Outlook Live domain with your Outlook Live administrator account and use the following information to create a new Windows Live user with a mailbox:
    • Display name: OLSync
    • Windows Live ID: OLSync@<tenant domain>.com

Need detailed help? See Create a New Mailbox.

2. Sign in with the service account

After you create the OLSync service account, sign out of the Outlook Live domain, and sign in to the Outlook Live domain again with the OLSync service account using Outlook Web App (https://www.outlook.com/owa). You have to do this one time to accept the terms of use for that new account. If you don't sign in to Outlook Web App and accept the terms of use, you will get Access Denied errors when you try to run FIM 2010 or ILM 2007 with the service account.

3. Connect Windows PowerShell on your local computer to Outlook Live

To use the OLSync service account, you have to elevate the permissions associated with the OLSync service account so it can be used by FIM 2010 or ILM 2007. To do this, you must connect Windows PowerShell to Outlook Live. Here's how: Connect Windows PowerShell to the Service

4. Assign the GALSynchronisationManagement RBAC role to the OLSync service account

The GALSynchronizationManagement role based access control (RBAC) role lets the OLSync service account run Exchange synchronisation cmdlets on your Outlook Live domain.

  • In a client-side session, run the following command:
    Copy
    New-ManagementRoleAssignment  -User OLSync@<tenant_domain> -Role GALSynchronizationManagement -Name "OLSync Svc Role"

5. Give the OLSync service account access to WinRM and disconnect

The last configuration you need to make to the service account is to give the account access to Windows Remote Management (WinRM) so FIM 2010 or ILM 2007 can connect Windows PowerShell to Outlook Live. After you have run the command to enable WinRM on the OLSync service account, be sure to close the current Windows PowerShell session.

  1. In a client-side session, run the following command:
    Copy
    Set-User OLSync@<tenant_domain> -RemotePowerShellEnabled $true
  2. In a client-side session, run the following command to disconnect Windows PowerShell from Outlook Live:
    Copy
    Remove-PSSession $rs

Test the OLSync service account

Because this OLSync service account will be used by FIM 2010 or ILM 2007 to synchronise your on-premises domain with your Outlook Live domain, the best way to test the configuration is to open a client-side session with the service account.

Open the session from the computer where FIM 2010 or ILM 2007 is installed.

To open a client-side session with Outlook Live, follow the procedure in Step 3, but instead of providing the Outlook Live administrator account credentials, use the OLSync service account credentials.

After you open the session, run the following cmdlets to make sure the account has the appropriate RBAC permissions:

  • Get-SyncMailbox
  • Get-AcceptedDomain

If you don't get any errors, the service account is ready to use.

If you can't run the cmdlets, the assignment of the GALSynchronizationManagement role may have failed. Perform step 4 again.

If you still can't run the cmdlets, you haven't successfully connected Windows PowerShell to Outlook Live. Perform step 3 again.

Read more