This guide is aimed at system administrators who are capable of connecting to remote systems such as Google Workspace (formerly G Suite) for Business and Office 365 Admin Panel.
Even if the new Cloudiway interface is user-friendly, GALSync is usually a detailed setup that requires a high level of competence and experience with mail systems and directories.
1.1. Global Address List Synchronization
This guide provides steps for setting up GALSync using the Cloudiway platform. GALSync stands for Global Address List Synchronization.
The goal of a GAL Synchronization is to keep the address books up to date by creating users from one side as contacts on the other side.
Although we provide support for our own products, we do not provide support for third-party products such as PowerShell or server administration of Google or Exchange.
To help you, we have prepared a demonstration video for you!
1.2. How it works:
(1) Pull users & groups from source tenant
(2) Pull target items from target tenant
(3) Push new items and updates to target tenant
1.4. Supported Systems
Note: On-Premises environments require a local agent to be running.
1.5. Performance & Security
We take your privacy and security seriously at Cloudiway, and we have invested significant effort into making our platform and your data secure. Cloudiway provides a cloud-based application hosted in Windows Azure… For more information about security, please refer to this article.
For more information about migration performance, please refer to this article.
GALSync setup requires the assistance of our consulting team. Should you need help, please drop an email here.
2.1. Office 365 Service account
The GALSync connector uses a mix of PowerShell commands and Graph API calls.
PowerShell command requires administrative privileges. The easiest approach is to use a tenant admin account. However, it’s possible to use an account with fewer privileges.
The following steps describe how to set up such account:
The account must be granted several roles:
In the Members area, add the licensed service account to the role group.
To create your Office 365 connector, check this article.
2.2. Google Workspace Service Account
The Google service account needs to be a super admin and requires a valid Google user license. However, you can add permission restrictions if you want.
From your Google Workspace migration account, give access to your API (Google feeds):
https://apps-apis.google.com/a/feeds/user/, https://apps-apis.google.com/a/feeds/groups/, https://apps-apis.google.com/a/feeds/policies/, https://www.google.com/m8/feeds/, https://apps-apis.google.com/a/feeds/alias/, https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/directory.readonly, https://www.googleapis.com/auth/contacts
To create your Google Workspace connector, check this article.
2.3. Azure Apps Registration
Graph APIs calls are performed through an Azure Active Directory Application which is granted specific permissions.
You can either create an Azure Active Directory Application manually or let the platform create one for you.
If you create the Application manually, you must grant the following permissions:
User.Read.All, Group.Read.All, Directory.Read.All OrgContact.Read.All To enable the modification of Guest or Mail user: User.ReadWrite.All To create items as Guests: User.Invite.All
Please consult our How To Create Azure Apps Registration page to create the Azure Active Directory Application and associated permissions.
The following chapter shows how to setup GalSync between Google Workspace, Office 365, and On-Premises environments.
3.1. Create Your Connectors
Connectors are multi-directional. Cloudiway needs to be able to communicate with both your source and target domains. To do this, Cloudiway uses connectors. Please refer to this page to configure your connectors.
When you create both connectors, make sure to select GALSync in Coexistence Products:
3.2. GALSync Configuration
Once your connectors are created, you must configure them for GALSync.
Go to GALSync > Configuration, select your connector.
3.2.1. Pulling Options
Select if you wish to enable the following options:
Note: The Cloudiway tools will still pull all objects in the tenant into the list, but will only push the objects based on your filtering rules above. When pulling or filtering by groups, only objects directly added to mail-enabled groups are supported. Nested groups or non-mail-enabled groups are not supported.
3.2.2. Pull Filters
If you don’t want to pull the entire directory, you can specify filters to synchronize only the objects of your choice.
The filters are based on attributes that match conditions:
3.2.3. Push Options
For Office 365, you can define various pushing options:
Push Type: source objects can be created as:
3.2.4. Push Customizations
The Push Customizations allows to select the attributes to push.
The Actions section allows you to manually synchronize your users between tenants. When your rules are correct, you can automate and schedule the synchronizations.
4.1. Manual Synchronization
This chapter explains how to synchronize your users between a source and a target tenant. This is a two-steps synchronization, the first step is to pull the users from the source and then to push them to the target.
Note: we highly recommend testing this process between two temporary tenants or with fake users before Pushing between the final tenants.
List of actions: Pull, Push, or Simulate.
4.2. Automatic Synchronization
When your rules are correct, you can automate the synchronization.
Select your Source and Target connectors. Ensure that the Automatic Run is enabled. Then click on the clock button.
Use the various tabs (Hourly, Daily, etc.) to plan the synchronization.
Don’t forget to select your Time Zone.
Finally, click on the ADD button above.
Switch to the History section to monitor the execution of your tasks, check the status of your jobs, and visualize the results.
Click on a job to display the results of the synchronization: Creations, Modifications, etc.
Scroll down the page. The Jobs Logs are available under the Jobs List.
Cloudiway provides an extensive knowledge base with many resources, including common error messages. Please visit the knowledge base here (where you can search for keywords or read through topics).
If you are concerned you might have any difficulty completing these steps, please consider a solution with our consulting team, contact us. This will ensure a fast, cost-effective, and stress-free implementation.