Admin Guide: GALSync

This guide is aimed at system administrators who are capable of connecting to remote systems such as G Suite for Business and Office 365 Admin Panel. GALSync is usually a detailed setup that requires a high level of competence and experience with mail systems and directories.


  1. About this guide
    1. Audience
    2. Using this guide
  2. Introduction
    1. What is Galsync?
    2. Features
    3. Supported Systems
  3. Security
  4. Set up Cloudiway for Galsync
    1. Before you start
    2. Cloudiway contacts
    3. Service accounts creation
      1. Office 365 Service account
      2. G Suite Service Account
    4. Azure Apps Registration
    5. Galsync Setup
  5. Test your Address List Synchronization
  6. Automatic schedule
  7. Troubleshooting


1. About this guide

1.1. Audience

Although we provide support for our own products, we do not provide support for third-party products such as PowerShell or server administration of Google or Exchange.

If you are concerned you might have any difficulty completing these steps, please consider a solution with our consulting team, contactable via This will ensure a fast, cost-effective and stress-free implementation.

1.2. Using this guide

This guide provides steps for setting up GALSync using the Cloudiway platform, as well as details of any remote system configuration required.

The screen dumps used in this guide reflect these business names to provide typical examples of data to enter into each field.

Whitepapers and guides covering Cloudiway’s other products, such as general mail migration, are available from the Cloudiway website (

2. Introduction

2.1. What is GALSync?

GALSync stands for Global Address List Synchronization.

The goal of a GAL Synchronization solution is to synchronize users, groups from one source messaging system with contact objects in another messaging system. It allows automatic updates between global address lists to ensure they remain synchronized.

GALSync works between multiple address books through a simple configuration online, which sends pull requests to other address books and pushes the changes to the targets.

How it works:

GALSync tenant source target

(1) Pull users & groups from tenant source

(2) Pull target items from tenant target

(3) Push items to target

2.2. Features

The GALSync engine is hosted on the Cloudiway platform, it’s a SAAS application. Address books of Cloud messaging systems can be synchronized without requiring to install anything.

  • Filter by domain: You can select the Domain Names that you want to synchronize.
  • Filter by object type: You can select to synchronize only users, groups or contacts
  • Simulation: A simulation mode is available to visualize and validate the changes before pushing them to the targets
  • Automatic schedule: Once the rules are in place and working correctly, you can schedule the execution and run it automatically at the time of your choice.
  • Logs: Execution logs are available to keep track of the errors and changes.

2.3. Supported Systems

  • G Suite
  • Office 365
  • Exchange on-premises ( 2007 and later )

Note: On-Premises environments require a local agent to be running.

3. Security

We take your privacy and security seriously at Cloudiway, and we have invested significant effort into making our platform and your data secure. Cloudiway provides a cloud-based application hosted in Windows Azure. It means that the software and data are centrally hosted and accessed by clients using a web browser and internet connection. In addition, Cloudiway’s SaaS benefits from Windows Azure’s certifications, ensuring the security of the infrastructure, network and physical security layers of the Cloudiway cloud.

4. Set up Cloudiway for GALSync

4.1. Before you start

Before you start, please ensure you have the details outlined in the following table.

Cloudiway loginStores details and provides communication between the systems you already use.
Knowledge base accessOur extensive knowledge base is always accessible, with videos, troubleshooting tools, samples and more.


4.2. Cloudiway contacts

GALSync setup might require the assistance of our consulting team.

Should you need help, please drop an email to with in cc.

4.3. Service Accounts Creation

This chapter explains how to create the service accounts in order to push (write) data to G Suite, Office 365.

4.3.1. Office 365 Service account

Method 1: Global admin account

The GalSync connector requires an Office 365 tenant admin account.

The reason is that Powershell cmdlets commands are run (PSSession, etc…)

Running these PowerShell commands require to be admin of the tenant.

Method 2: Standard user account

The GALSync O365 service account needs to perform some administrative tasks on your O365 environment to function properly.

The preferred method is to use the Global Administrator role for the GALSync service account. However, there are times when you must set up a service account with limited permissions. It is possible to follow these steps and apply special permissions to the GALSync service account to restrict its access to your tenant.

Warning: This method is not recommended by Cloudiway and is not guaranteed to work in your scenario.

First, you must use a licensed user account. In our tests, we successfully used a dedicated service account with the Business Essentials license.

Second, this account must be able to make PowerShell connections to your tenant. See Microsoft’s current documentation on how to achieve this.

Third, the account must be granted certain roles. To do this:
1. Go to the O365 Exchange Admin Center
2. Select “permissions”
3. Select “admin roles”
4. Create a new role group
5. Give the group a name, description, and set the Write scope to Default
6. Assign these three roles to the role group:
a. Address Lists
b. Mail Recipient Creation
c. Mail Recipients
7. In the Members, area add the licensed service account to the role group
8. Click Save

Once these steps are completed, enter the username and password for this account in your GALSync O365 Target Connector, click save, and click Verify. The verify should complete without errors.

4.3.2. G Suite Service Account

  1. Go to and log in with your Admin console credentials
  2. Click on Security, then Advanced settings (you might need to click on Show more to see this)
  3. Click on Manage API client access
  4. In the Client Name: paste 114818336788408865729
  5. Click on the One Or More API Scopes field and add the following scope:,,,,,,


    1. Each scope must be separated by a comma.
    2. Some scopes require slashes (/) at the end and others don’t: please use the above strings.
    3. If you add another scope later, existing scopes will be removed: you need to add the whole list at the same time.

  6. Click on the Authorize button
  7. You can check that the scopes were successfully registered by looking for the names next to the client ID you paste
  8. Now, navigate to Security > API Reference > API Access and ensure that ‘Enable API Access’ is checked.


4.4. Azure Apps Registration

Please refer to this page for Azure Apps registration.

Note: Set the following permissions to the application

User.Read.All, Group.Read.All, Directory.Read.All

4.5. GALSync Setup

The following chapter shows how to setup GalSync between Gsuite, Office 365 and On-Premises environments.

Connectors are multi-directional.

Setup of a connector

      1. From your browser, go to and login or register if you do not have any account.
      2. First, you need to create a project in order to be able to configure the connectors.
        Click on Create Project.
      3. Click on the pull-down list at the top left of your screen, then click on Configuration.
      4. To create a new connector (source or target), click on New.
      5. Choose the connectors in relation to your tenants (source and target) and give them a name.
      6. Then click on Add.
      7. Fill the required fields under the account settings section then click on Next.
      8. If you need to set up filters, you will be able to do it under the next section called Pulling Filters.
      9. Once the configuration of your connector is finished click on Next, then on Complete under the End: Summary section.
      10. Now you should be able to see your connector under the section Configuration.
      11. Please note, for the configuration of an Office 365 connector, more fields will need to be filled.
        You can follow the instructions contains in this article to help you get this information.

5. Test your Address List Synchronization

Under the Actions section you’ll be able to complete a full synchronization cycle in a four-step process:

Choose your Source and Target connectors and under the Manual Run section click on the action you want to execute.


This action is mainly used to verify if your pulling filter matches your needs as it only gathers data (users and groups) from the selected source.
Each pull is differential: only changes will be saved on our side.


This action first gathers contacts from the selected targets, then displays which changes would be made if you push data to your targets. You can check the simulation results by clicking on any job simulation in the Jobs List then clicking on View Simulation.


To avoid throttling when writing to your tenants, the push first gathers contacts of the target, then push changes.

Empty Cloudiway’s cache

You can empty our cache if you want. This action cannot be performed when an action is already processing.
(This action could break some links in screens. An automatic process will repair/delete them once a day.)


Switch to the Job List view under the History section to monitor the execution of your tasks, check the status of every job request and the time when they were started and ended.

By clicking on a job in the Jobs List you can see informations concerning the Users, the Groups, and the Contacts, and check what can be the differents possible changes in the target, for example what has been created, modified, deleted or ended in error.

In the Jobs Logs section at the bottom of the Jobs List, you can get further informations about the jobs.

If everything is correct, you are now ready to push the changes.

Select the target connectors and click on Push under the Action section.

Click on Start.

Your GALSync synchronization is now completed.

6. Automatic schedule

When everything is up and running, you can schedule the synchronization to run every x hours.
More information in this article, at section 4. Automatic Action.

Typical configuration:

– Automatic run period: 24 hours.
– Automatic Pull Targets:
o This will ensure that target connectors are pulled at each pass.
o In large environments, Cloudiway might advise you to pull the targets every n passes.

7. Troubleshooting

Cloudiway provides an extensive knowledge base with many resources, including common error messages, video guides and downloads.

Please visit the knowledge base here (where you can search for keywords or read through topics):

The knowledge base also contains information on how you can ask for further support, should you require it.

Download PDF Here:
Free trial
Want to try?
Free trial
Any questions?