Adding Objects, Forests or Partner Organizations to an Existing GALsync Deployment

Purpose

An existing synchronization needs to grow — more people than the licence covers, another Active Directory forest, or a new partner organization. This article covers what changes commercially and technically, and the order to do it in.

What a licence is sized on

Two dimensions, and both can force a change independently:

Mail-enabled objects — how many objects may be synchronized.
Organizations or forests — how many environments participate.

So adding a partner can require a licence change even when your object count has not moved, and growing past your object ceiling requires one even with no new partners. Expansions are quoted in those units — for example, adding a number of objects and one forest.

Two commercial details worth knowing before you ask:

An expansion is normally co-termed to your existing subscription rather than starting a fresh term.
Expansions may include implementation and configuration services for the guided setup. If you would rather do the work yourself, say so when asking, rather than assuming the quote is licence-only.

Do this before you are blocked

Plan on the basis that hitting the object ceiling stops synchronization rather than degrading it. The object count is worth monitoring as a capacity metric, not just checking when something breaks.

# Roughly, how many objects would a scope export?
(Get-DynamicDistributionGroup -Identity '<group>' | ForEach-Object {
    Get-Recipient -RecipientPreviewFilter $_.RecipientFilter -ResultSize Unlimited
}).Count

Compare that against your licensed ceiling with enough headroom for normal growth. An acquisition, an onboarding wave or a newly included OU can consume the margin quickly.

Adding capacity: the sequence

Establish the new numbers — object count and organisation or forest count — and request the licence on that basis. Include the exact product version.
Apply the new key at Help → About → Add License.
Confirm the new ceiling is in effect before widening any scope. Check that the licence shows the counts you expect.
Then widen the export scope.
Run the export manually and confirm the object count rose to what you expected, before letting the import run.

Apply the licence before widening the scope, not after. An export that exceeds the licensed ceiling is a failure you have to unwind, and during it the data file may be short — which is how a capacity change becomes a deletion event at the partner.

Set Minimum objects to transfer data file before you make the change. See How to Prevent GALsync Contact Deletion During Export Errors.

Adding an Active Directory forest

Beyond the licence, a new forest needs the operational pieces:

The GALsync service account needs the rights to read the new forest, and write permission on the target OU if objects will be imported into it.
The new forest's objects need to fall within an export scope — a group or OU selection on the policy's Directory tab.
Confirm which recipient types in the new forest need to be exportable, particularly if it is hybrid and holds remote mailboxes.

Note also that from version 8.6.0, domains in an Active Directory forest can be excluded from synchronization where you do not have access to all of them — useful when adding a forest you only partly administer.

Adding a partner organization

A new partner is a new pair of one-way flows, not an addition to an existing one. The rules that matter:

Each import policy gets its own target container. Two import policies writing into the same OU delete each other's contacts.
Only one export policy should target a given Exchange Online organization from the same source, for the same reason.
All partners must be on the same version. Adding a partner on an older build affects everyone in the scheme, not just the new pair.

Beyond two or three environments, a hub-and-spoke arrangement is usually more maintainable than full mesh. See Setting Up Two-Way GALsync Between Multiple Tenants.

Verify after expanding

Export object count matches the new expected total.
No policy reports licence warnings.
A sample of newly included objects appears correctly at the target.
Previously synchronized contacts are still present — confirm the expansion added rather than displaced.
The scheduled run behaves the same as the manual one.

References

GALsync 8.7 Manual p.12 — one import policy per organizational unit; one export policy per Exchange Online target.
GALsync 8.6.0 changelog — excluding Active Directory domains from synchronization.
GALsync 8.7 Manual p.167 — export safety limits.
The current GALsync manual is published by NETsec at netsec.de.

Articles in this section