Office 365: The mystery of mobile phone…
In the last few weeks I have worked several escalations from customers inquiring about inconsistencies with the mobile phone attribute. In almost all cases inconsistencies were noticed in the Exchange Online contact card where mobile phone listed did not match on premises.
When directory synchronization is enabled on an Office 365 tenant a set of attributes are locked with a source of authority flag establishing on premises as the SOA. The implications here are that changes to these attributes should only be accepted through the Azure Active Directory Synchronization software. Administrators and end users can see this behavior when attempting to change – for example – first name.
PS C:\> Set-MsolUser -UserPrincipalName tim.mcmichael@domain.com -FirstName Test
Set-MsolUser : Unable to update parameter. Parameter name: FIRSTNAME.
At line:1 char:1
+ Set-MsolUser -UserPrincipalName tim.mcmichael@domain.com -FirstName ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [Set-MsolUser], MicrosoftOnlineException
+ FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.PropertyNotSettableException,Microsoft.Online.Administration.Automation.SetUser
As with other attributes mobile phone is initially setup with the expectation that it will be provided through the Azure Active Directory Synchronization software. Let us review a sample user:
The remote mailbox object is provisioned on-premises and a mobile number set.
[PS] C:\>Get-User testmobile | fl *mobile*
MobilePhone : 8035551212
The recipient is successfully replicated to Azure Active Directory and the mobile number from on premises is retained.
PS C:\> Get-MsolUser -UserPrincipalName testmobile@fortmillems.org | fl *mobile*
AlternateMobilePhones : {}
MobilePhone : 8035551212
At anytime the mobile number may change on premises to a different value.
[PS] C:\>Set-User testmobile -MobilePhone 9991112222
[PS] C:\>Get-User testmobile | fl *mobile*
MobilePhone : 9991112222
The recipient is again successfully replicated to Azure Active Directory and the mobile number from on premises is again retained.
PS C:\> Get-MsolUser -UserPrincipalName testmobile@domain.com | fl *mobile*
AlternateMobilePhones : {}
MobilePhone : 9991112222
In Office 365 there are several self service options for attributes. For example users can enroll themselves in Multi-Factor Authentication or potentially manage some of their personal attributes. One of these attribute is mobile phone. This allows the end user to set their own mobile phone number. In addition administrators have access to user attribute both via the portal and powershell where mobile phone can also be adjusted.
PS C:\> Get-MsolUser -UserPrincipalName testmobile@domain.com | fl *mobile*
AlternateMobilePhones : {}
MobilePhone : 1234567890
So wait – mobile phone was previously accepted from on premises when directory synchronization was enabled but is now also taking updates from Azure Active Directory directly? That’s correct – mobile phone is a unique attribute. When directory synchronization is enabled mobile phone will continue to be populated from on premises through the sync process. Although this occurs – the mobile phone can be updated through any number of cloud interfaces. What happens now if the mobile number changes on premises.
[PS] C:\>Set-User testmobile -MobilePhone 0987654321
[PS] C:\>Get-User testmobile | fl *mobile*
MobilePhone : 0987654321
Synchronization is now allowed to complete and reviewing the attributes of mobile number in Azure Active Directory we note the attribute HAS NOT updated.
PS C:\> Get-MsolUser -UserPrincipalName testmobile@domain.com | fl *mobile*
AlternateMobilePhones : {}
MobilePhone : 1234567890
This is by design. When the mobile phone number was adjusted in Azure Active Directory the source of authority was changed from on premises to Azure Active Directory. When Azure Active Directory Sync pushes any changes of the mobile attribute from on premises to Office 365 – Azure Active Directory ignores the change.
So what about Exchange Online – what will display in the users contact card. Exchange Online takes all of the information as provided by Azure Active Directory. Regardless where the source of authority lies – the value stamped on the object in Azure Active Directory will be the value of the attribute on the mail enabled object in Exchange Online and what will subsequently appear in the global address list. Here is a sample get-user from Exchange Online:
PS C:\> Get-User testMobile | fl *mobile*
MobilePhone : 1234567890
If you have mobile phone attributes that you need populated from on premises to Office 365 and are encountering this issue a support case can be utilized to discuss options with product support services.