Admin Guide: GALSync


  1. About this guide
    1. Audience
    2. Using this guide
  2. Introduction
    1. What is Galsync?
    2. Features
    3. Supported Systems
  3. Security
  4. Set up Cloudiway for Galsync
    1. Before you start
    2. Cloudiway contacts
    3. Galsync Setup
      1. Setup of a source Gsuite connector
      2. Setup of a target Gsuite connector
      3. Setup of a source Office 365 connector
      4. Setup of a target Office 365 connector
      5. Provisioning configuration
  5. Test your Address List Synchronization
    1. Pull the connectors
    2. Reconcile
    3. Export
  6. Specific scenario: On-premises Active Directory
  7. Automatic schedule
  8. Troubleshooting

1. About this guide

1.1. Audience

This guide is aimed at system administrators who are capable of connecting to remote systems such as G Suite for Business and Office 365 Admin Panel. GALSync is usually a detailed setup that requires a high level of competence and experience with mail systems and directories.

Although we provide support for our own products, we do not provide support for third-party products such as PowerShell or server administration of Google or Exchange.

If you are concerned you might have any difficulty completing these steps, please consider a solution with our consulting team, contactable via This will ensure a fast, cost-effective and stress-free implementation.

1.2. Using this guide

This guide provides steps for setting up GALSync using the Cloudiway platform, as well as details of any remote system configuration required.

The screen dumps used in this guide reflect these business names to provide typical examples of data to enter into each field.

Whitepapers and guides covering Cloudiway’s other products, such as general mail migration, are available from the Cloudiway website (

2. Introduction

2.1. What is GALSync?

GALSync stands for Global Address List Synchronization.

The goal of a GAL Synchronization solution is to synchronize users, groups and contacts from one source messaging system with contacts objects in another messaging system. It allows automatic updates between global address lists to ensure they remain synchronized.

GALSync works between multiple address books through a simple configuration online, which sends pull requests to other address books and pushes the changes to the targets.

2.2. Features

The GALSync engine is hosted on the Cloudiway platform, it’s a SAAS application. Address books of Cloud messaging systems can be synchronized without requiring to install anything.

  • Filter by domain: You can select the Domain Names that you want to synchronize.
  • Filter by object type: You can select to synchronize only users, groups or contacts
  • Preview: A preview mode is available to visualize and validate the changes before pushing them to the targets
  • Attribute selection: The schema is open and extensible. Any attribute present in the source can be synchronized without coding.
  • Automatic schedule: Once the rules are in place and working correctly, you can schedule the execution and run it automatically at the time of your choice.
  • Logs: Execution logs are available to keep track of the errors and changes.

2.3. Supported Systems

  • G Suite
  • Office 365
  • Exchange on premises ( 2007 and > )
  • A possibility of Lotus Notes.

Note: On-Premises environments require a local agent to be running.

3. Security

We take your privacy and security seriously at Cloudiway, and we have invested significant effort into making our platform and your data secure. Cloudiway provides a cloud-based application hosted in Windows Azure. It means that the software and data are centrally hosted and accessed by clients using a web browser and internet connection. In addition, Cloudiway’s SaaS benefits from Windows Azure’s certifications, ensuring the security of the infrastructure, network and physical security layers of the Cloudiway cloud.

4. Set up Cloudiway for GALSync

4.1. Before you start

Before you start, please ensure you have the details outlined in the following table.

Name Description Location
Cloudiway login Stores details and provides communication between the systems you already use.
Knowledge base access Our extensive knowledge base is always accessible, with videos, troubleshooting tools, samples and more.


4.2. Cloudiway contacts

GALSync setup might require the assistance of our consulting team.

Should you need help, please drop an email to with in cc.

4.3. Service Accounts Creation

This chapter explains how to create the service accounts in order to synchronize G Suite, Office 365 and on Premises Exchange servers

4.3.1 On-Premises Exchange service Account

When you synchronize to or From an On-Premises Exchange server, it requires a local agent.

The agent runs with the identity of the logged on user.

If you are using the On-Premises environment as a source connector, all you need is an Active Directory account with ReadOnly access to the objects or organizational Units that will be pulled.

If you are using the On-Premises environment as a target connector, the read/write operations are performed using Exchange Powershell commands under the identity of the account that has launched the local agent. This account needs Exchange admin privileges and the authorization to run Powershell commands.

4.3.2. Office 365 Service account

Method 1: Global admin account

The GalSync connector requires an Office 365 tenant admin account.

The reason is that Powershell msol cmdlets commands are run (Get-MsolUsers, etc…)

Running these PowerShell commands require to be admin of the tenant.

Method 2: Standard user account

The GALSync O365 service account needs to perform some administrative tasks on your O365 environment to function properly.

The preferred method is to use the Global Administrator role for the GALSync service account. However, there are times when you must set up a service account with limited permissions. It is possible to follow these steps and apply special permissions to the GALSync service account to restrict its access to your tenant.

Warning: This method is not recommended by Cloudiway and is not guaranteed to work in your scenario.

First, you must use a licensed user account. In our tests, we successfully used a dedicated service account with the Business Essentials license.

Second, this account must be able to make PowerShell connections to your tenant. See Microsoft’s current documentation on how to achieve this.

Third, the account must be granted certain roles. To do this:
1. Go to the O365 Exchange Admin Center
2. Select “permissions”
3. Select “admin roles”
4. Create a new role group
5. Give the group a name, description, and set the Write scope to Default
6. Assign these three roles to the role group:
a. Address Lists
b. Mail Recipient Creation
c. Mail Recipients
7. In the Members, area add the licensed service account to the role group
8. Click Save

Once these steps are completed, enter the username and password for this account in your GALSync O365 Target Connector, click save, and click Verify. The verify should complete without errors.

4.3.3. Gsuite Service Account

This article describes how to create a service account for G Suite:

In particular, the service account needs the permissions for the following feeds:,,,,,,,,,

4.4. GALSync Setup

The following chapter shows how to setup GalSync between Gsuite, office 365 and On-Premises environments.

Connectors are mono-directional.

To set up a synchronization between G Suite and Office 365, you need to create a source and a target connector of each type.

4.4.1. Setup of a source G Suite connector

From your browser, go to And login
Click on Identity Management.

On the connectors List, Click New

Select G Suite Source

Give a name to your connector and click Create  
In Main settings, fill the required fields.

Administrator: the name of an account that will be impersonated.

Service Account Email and service Account Certificate: See the above chapter to see how to create the service account

Domains: the domains to

 Click on Verify.

This will validate that the settings are correct

Synchronization rules.

To Enable GALSync, activate Pull Users as Contacts and Pull Groups as contacts (if you wish to synchronize groups as well).

Domain Mapping.

Do not make any domain

 Reconciliation rules. Leave the defaults rules

(mail exact match is relevant for messaging  systems).

Attribute Mapping. The default List is sufficient
Pulling filters. Reserved for later use. Do not set yet any pulling filters. In a next version, you will

be able to synchronize members of a specific group.

Today, only filtering by attribute value is active.
No rules mean that all objects are synchronized.

Provisioning rules.

This tab will be filled later.


4.4.2. Setup of a target G Suite connector.

Repeat the above procedure but this time, select a target Gsuite Connector.

Activate the GALSync and select to create users as contacts.

Also, Enable the synchronization of contacts

The rest of the configuration is identical to the previous step.

4.4.3. Setup of a source Office 365 connector

Let’s now create the source Office 365 connector

Enter the credentials for the Office 365 connector.

Select Pull Users as a contact (this actually activates the GALSync).

Click on Verify to validate your settings.

4.4.4. Setup of a target Office 365 connector

Let’s now create the target Office 365 connector.

Repeat the above step by selecting a target Office 365 connector.

Click on Verify to validate your settings.

Select Synchronize GAL and Create as Contact

Do not set the other fields since we are not going to provision users.

The connectors are now created.

4.4.5. Provisioning configuration

The final step is to configure the provisioning.

We want the G Suite source connector to provision the target office 365 connector and vice-versa.

Edit the source G Suite connector and allow it to provision the target Office 365 connector

Edit the source Office connector and allow it to provision the target G Suite connector

Your configuration is now completed.

It’s now time to test it.

5. Test your Address List Synchronization

A full synchronization cycle is a three-step process:

–  Pulling of the sources.
o This pulls every connector and stores the objects in an internal cache (connector caches).

–  Reconciliation
o It updates the connector caches.
o You can visualize the changes, changes (creation, modifications, deletions) that are ready to be exported.

–  Export to target
o This writes the changes to the tenants.

5.1. Pull the connectors

In the connector List, select all the connectors and Click Pull

Click on Confirm.

Switch to the Job List view to monitor the execution of your tasks

5.2. Reconcile

In the connector list, select the connectors and click on Reconcile

Click on Confirm to start the Process.

You can visualize the results of the reconciliation in the connectors.

If everything is correct, you are now ready to export the changes.

5.3. Export

Select the target connectors and click on Export

Click on confirm.

Your GALSync synchronization is now completed.

6. Specific scenario: On-premises Active Directory

6.1. OnPrem Active Directory as a source

If you have an On-Premises Exchange environment, objects are stored in the Active Directory

You can create an Active Directory source connector to pull the users, groups and contacts and sync them in the targets of your choice

In the connector list, create a new connector of type AD Source
Give it a name and click on Create
Fill the required fields.

Username/password must be a single user that has permissions to read the organizational units that you have selected

Synchronization rules Enable Synchronize contacts. Enable Pull Users as Contacts

By default, all the users of the AD are synchronized.

You can select to pull specific Organizational units (Selection by OU)
or members of a Given Group (Selection by Group)


The configuration is now completed.

Now you need to download the local agent and its configuration file and run it locally from a member server.

In the connector configuration, at the bottom of the configuration, there are 2 links to download the local agent.

6.2. OnPrem Active Directory as a target

The Cloudiway SAAS platform also allows to provision On-Premises Active Directory.

In the connector list, create a new connector of type Active Directory Target
Give it a name and click on Create
Fill the required fields.

Username/password must be a single user that has permissions to read the organizational units that you have selected

Enable Synchronize GAL

Enable Synchronize Contacts

The target AD connector works differently from the other.

Provisioning actions are written in PowerShell and you have the control and ability to modify it. It’s using Exchange PowerShell to manipulate objects.

Below is an example of a provisioning script.

Please contact our consulting team to get a complete working script.


CreateContact #********************************* Function CreateContact





$Name = GetAttributeValue $Attributes “mail”

if (!$Name)



$err = “Error: Name is not provided : ” + $UTFDecoded return $err




$FirstName = GetAttributeValue $Attributes “FirstName”

$LastName = GetAttributeValue $Attributes “LastName”

$DisplayName = GetAttributeValue $Attributes “DisplayName”

$Alias = GetAttributeValue $Attributes “Alias”

$externalEmailAddress = GetAttributeValue $Attributes “mail”

$country = GetAttributeValue $Attributes “country”

$City = GetAttributeValue $Attributes “City”

$Department = GetAttributeValue $Attributes “Department”

$State = GetAttributeValue $Attributes “State”

$Office = GetAttributeValue $Attributes “Office”

if (!$LastName )


$LastName = $null


if (!$firstName )


$firstName = $null


Write-Host “FirstName = $FirstName , LastName = $LastName , DisplayName = $DisplayName ,

Alias= $Alias”

$ADGuid = new-MailContact -Name $Name -DisplayName $DisplayName – OrganizationalUnit $OrganizationalUnit -DomainController $DCName -FirstName $FirstName – LastName $LastName -externalEmailAddress $externalEmailAddress -alias $Alias

Write-Host “after new-MailContact $($ADGuid.Guid)”

#Set-MailContact -identity $Name -HiddenFromAddressListsEnabled $true – DomainController $DCName

Now set additional attributes if (!$country )


Set-Contact -identity $Name -city $City -Department $Department -state $State –

office $Office -DomainController $DCName




Set-Contact -identity $Name -city $City -Department $Department -state $State -office $Office -country $country -DomainController $DCName


#return the AD Guid.

write-host $ADGuid.Guid

return $ADGuid.Guid


7. Automatic schedule

When everything is up and running, you can schedule the synchronization to run every x hours. Click on Global Settings.

Schedule it to run every 24 hours. (It’s usually sufficient to run one sync per day).

Typical configuration:

– Automatic run period: 24 hours.
– Automatic Pull Targets:
o This will ensure that target connectors are pulled at each pass.
o In large environments, Cloudiway might advise you to pull the targets every n passes.

8. Troubleshooting

Cloudiway provides an extensive knowledge base with many resources, including common error messages, video guides and downloads.

Please visit the knowledge base here (where you can search for keywords or read through topics):

The knowledge base also contains information on how you can ask for further support, should you require it.

Download PDF Here:
Free trial
Want to try?
Free trial
How it works
Any questions?