Admin Guide: GALSync

This guide is aimed at system administrators who are capable of connecting to remote systems such as G Suite for Business and Office 365 Admin Panel.

Even if the new Cloudiway interface is user-friendly, GALSync is usually a detailed setup that requires a high level of competence and experience with mail systems and directories.

Overview:

  1. Introduction to GALSync
  2. Prerequisites
  3. Set up Cloudiway for GALSync
  4. Synchronization
  5. History
  6. Troubleshooting

1. Introduction to GALSync

1.1. Global Address List Synchronization

This guide provides steps for setting up GALSync using the Cloudiway platform. GALSync stands for Global Address List Synchronization.

The goal of a GAL Synchronization is to keep the address books up to date by creating users from one side as contacts on the other side.

Although we provide support for our own products, we do not provide support for third-party products such as PowerShell or server administration of Google or Exchange.

1.2. How it works:

GALSync tenant source target

(1) Pull users & groups from source tenant

(2) Pull target items from target tenant

(3) Push new items and updates to target tenant

Read more: How GALSync Fields Are Mapped Between Tenants

1.3. Features

  • You can synchronize all your contacts or granularly select the objects.
    • Filter by domain: You can select the Domain Names that you want to synchronize.
    • Filter by object type: You can select to synchronize only users, groups, or contacts.
  • User type: Insert into address book as Mail enabled users, Contacts, or Guest users. Displayed or hidden from the address book.
  • Simulation: A simulation mode is available to visualize and validate the changes before pushing them to the targets.
  • Automatic schedule: Once the rules are in place and working correctly, you can schedule the execution and run it automatically at the time of your choice.
  • Logs: Execution logs are available to keep track of the errors and changes.

1.4. Supported Systems

  • G Suite
  • Office 365
  • Exchange on-premises ( 2007 and later )

Note: On-Premises environments require a local agent to be running.

1.5. Performance & Security

We take your privacy and security seriously at Cloudiway, and we have invested significant effort into making our platform and your data secure. Cloudiway provides a cloud-based application hosted in Windows Azure… For more information about security, please refer to this article.

For more information about migration performance, please refer to this article.

2. Prerequisites

GALSync setup requires the assistance of our consulting team. Should you need help, please drop an email here.

2.1. Office 365 Service account

The GALSync connector uses a mix of PowerShell commands and Graph API calls. Therefore it requires specific permissions at the source and at the target.

PowerShell command requires administrative privileges.

The easiest approach is to use a tenant admin account. However, it’s possible to use an account with fewer privileges. The following steps describe how to set up such account:

  1. You must use a licensed user account.
  2. This account must be able to run PowerShell commands.
  3. The account must be granted several roles:
    1. Go to the O365 Exchange Admin Center
    2. Select “permissions”
    3. Select “admin roles”
    4. Create a new role group
    5. Give the group a name, description, and set the Write scope to Default
    6. Assign the following roles to the role group:
Address Lists
Mail Recipient Creation
Mail Recipients

7. In the Members, area add the licensed service account to the role group
8. Click Save

To create your Office 365 connector, check this article.

2.2. G Suite Service Account

From your G Suite migration account, give access to your API (Google feeds):

https://apps-apis.google.com/a/feeds/user/,
https://apps-apis.google.com/a/feeds/groups/,
https://apps-apis.google.com/a/feeds/policies/,
https://www.google.com/m8/feeds/,
https://apps-apis.google.com/a/feeds/alias/,
https://www.googleapis.com/auth/admin.directory.user,
https://www.googleapis.com/auth/admin.directory.user.readonly

To create your G Suite connector, check this article.

2.3. Azure Apps Registration

Graph APIs calls are performed through an Azure Active Directory Application which is granted specific permissions.

You can either create an Azure Active Directory Application manually or let the platform create one for you.

If you create the Application manually, you must grant the following permissions:

User.Read.All, 
Group.Read.All, 
Directory.Read.All
OrgContact.Read.All

To enable the modification of Guest or Mail user:
User.ReadWrite.All

To create items as Guests:
User.Invite.All

Please consult our How To Create Azure Apps Registration page to create the Azure Active Directory Application and associated permissions.

3. Set up Cloudiway for GALSync

The following chapter shows how to setup GalSync between Gsuite, Office 365, and On-Premises environments.

3.1. Create Your Connectors

Connectors are multi-directional. Cloudiway needs to be able to communicate with both your source and target domains. To do this, Cloudiway uses connectors. Please refer to this page to configure your connectors.

When you create both connectors, make sure to select GALSync in Coexistence Products:

G Suite and Office 365 Connectors

3.2. GALSync Configuration

Once your connectors are created, you must configure them for GALSync.

Go to GALSync > Configuration, select your connector.

3.2.1. Pulling Options

Pulling Options

Select if you wish to enable the following options:

  • Pull Groups: the list of groups are created in the address book in the other side.
  • Pull Disabled Users: whether or not to synchronize disabled users.
  • Pull External Users: whether or not to synchronize external users.
  • Pull Specific Groups: synchronize only members of the groups.
  • Exclude Specific Groups: synchronize everything except the members of specific groups.

3.2.2. Pull Filters

Pulling Filters

If you don’t want to pull the entire directory, you can specify filters to synchronize only the objects of your choice.

The filters are based on attributes that match conditions:

  • Equals
  • DoesNotEqual
  • Contains
  • DoesNotContain
  • StartWith
  • DoesNotStartWith
  • MatchRegex
  • DoesNotMatchRegex
  • DateAfter
  • DateBefore
  • EndsWith
  • DoesNotEndWith

3.2.3. Push Options 

For Office 365, you can define various pushing options:

GALSync Office 365 Push Options

Push Type: source objects can be created as:

  • Contact: use this option to only add email addresses in the address book. This option doesn’t allow future migration of the contact to the tenant. We do not recommend this option.
  • Mail Enabled User: use this option if you plan to migrate your users to this tenant (when you are ready to migrate, just add a O365 License to the mail enabled user).
  • Guest User: (activated by default) use this option to allow adding the guest users into Microsoft Teams or SharePoint Sites. Cloudiway recommends this option.

Push Options

  • Push Groups: enable or disable publications of group email addresses in the address book.
  • Push Empty Fields: propagate empty fields. If the field is empty at the source but not at the target, the target value will be deleted.
  • Force display in address list: used only for guest users. By default, Office 365 hides guest users from the address book. This option allows making them visible.

3.2.4. Push Customizations

The Push Customizations allows to select the attributes to push.

Office 365:

GALSync Office 365 Push Customizations

G Suite:

GALSync Push Customization

4. Synchronization

The Actions section allows you to manually synchronize between tenants. When your rules are correct, you can automate and schedule the synchronizations.

G Suite Office 365 Synchronization

4.1. Manual Synchronization

To manually synchronize, choose your Source and Target connectors.

Then select an action: Pull, Push, or Simulate.

  • Pull: This action is pulling the source connector.
  • Push: The Push action is performing different actions: it’s pulling the data from the target. It then determines what needs to be pushed, and finally pushes the changes.
  • Simulate: Similar to the Push action except that it is not making any changes to the target. You can check the simulation results by clicking on the job (in the History section from the side menu) then clicking on View Simulation.
  • Clear cache: Use this option to empty the internal cache. This action cannot be performed while an action is already processing.

4.2. Automatic Synchronization

When your rules are correct, you can automate the synchronization.

Select your Source and Target connectors. Ensure that the Automatic Run is enabled. Then click on the clock button.

GALSync Automatic Run

Use the various tabs (Hourly, Daily, etc.) to plan the synchronization.

GALSync Synchronization Days Time

Don’t forget to select your Time Zone.

GALSync-TimeZone

Finally, click on the ADD button above.

More information about the cron syntax available here: https://en.wikipedia.org/wiki/Cron
You can test your cron string here : https://cronjob.xyz/ 

5. History

Switch to the History section to monitor the execution of your tasks, check the status of your jobs, and visualize the results.
GALSync History

Click on a job to display the results of the synchronization: Creations, Modifications, etc.

Scroll down the page. The Jobs Logs are available under the Jobs List.

GALSync Jobs Logs

6. Troubleshooting

Cloudiway provides an extensive knowledge base with many resources, including common error messages. Please visit the knowledge base here (where you can search for keywords or read through topics).

If you are concerned you might have any difficulty completing these steps, please consider a solution with our consulting team, contact us. This will ensure a fast, cost-effective, and stress-free implementation.

Cloud Migration Cloudiway
Want to try?
BOOK A DEMO
Cloud Migration Questions
Any questions?
Contact