The InterpretedUserType is an incredible source of information when it comes to Hybrid Skype for Business Deployments including for Interop with Microsoft Teams Users. You can identify with this Attribute if your Skype for Business Hybrid Configuration is in a Healthy state as this InterpretedUserType will clearly show you if a certain user has been synchronized and configured correctly for Skype for Business Hybrid or not.
To get this information for users you can use the following commandlet
get-csonlineuser | select Userprincipalname, InterpretedUserType
If may find some problems with certain users, specifically users that are not in the following states must be fixed for a correctly configured Hybrid State.
Faulty State for InterpretedUserType
- PureOnline (PureOnlineSfBUser)
- DirSyncedPureOnline (DirSyncedPureOnlineSfBUser)
Correct State for InterpretedUserType
- HybridOnline (HybridOnlineSfBUser)
- HybridOnprem (HybridOnpremSfBUser)
You may ask yourself when these issues are occurring, well that is entirely the fault of the Office 365 Admin and not taking into account Hybrid deployments. So essentially the issue arises when someone enables the Skype for Business Online license to a user that is not in the correct Hybrid state for InterpretedUserType. Office 365 will automatically provision this user for Skype for Business Online but will not honor the Hybrid configuration and break the Healthy Hybrid state at least for those users.
If you see this InterpretedUserType starting with Hybrid for a specific User this means that it is correctly configured in both Skype for Business On-Prem and Skype for Business Online. If the InterpretedUserType is either PureOnline or DirSynchedPureOnline then this user is only known in Skype for Business Online and essentially incorrectly configured.
There are a few things you can do to correct these faulty states.
First of all the User has to be known in Active Directory (also Synchronized correctly to Azure AD) and in both Cases you ultimately have to make sure that Skype for Business On-Prem has a knowledge of this Online Only user by fixing the On-Prem Active Directory Attributes and executing the below command. After this the AAD Connect Sync will kick in and flip the faulty users into healty Hybrid Online users.
Enable-CsUser -Identity “username” -SipAddress “sip:firstname.lastname@example.org” -HostingProviderProxyFqdn “sipfed.online.lync.com”
If you compare a healthy Skype for Business ON-PREM & Online user you would find the following attributes to be important
This has been the experience for a few years now but some changes are happening, keep on reading …
Update One (October 2018 timeframe)
Somewhere after Ignite Microsoft has changed the following Attributes and added SFBUser after the original named InterpretedUserType
- PureOnline to PureOnlineSfBUser
- DirSyncedPureOnline to DirSyncedPureOnlineSfBUser
- HybridOnline to HybridOnlineSfBUser)
- HybridOnprem to HybridOnpremSfBUser)
This is not a problem and the overall process did not change
Update Two (November 2018 Timeframe)
It seems that now Microsoft has built in some checks to prevent this misconfiguration from happening as when you are actually applying a License now Microsoft Checks if there is a Hybrid Deployment and if so prevents the creation of this Online Only user.
Now you will see InterpretedUserType to be configured as DirSyncSfBUserWithMCOValidationError instead of DirSyncedPureOnlineSfBUser preventing the User from being Skype for Business Online enabled. The following error will be visible in the MCOValidationError field for this user and the Key part says “The DNS record lyncdiscover.contoso.com (HostName=lyncdiscover.contoso.com) does not resolve to the Skype for Business Online domain name space. Either update the DNS record to the Skype for Business Online domain name space to have this user hosted in Skype for Business Online, or remove the Skype for Business license if this user is hosted On Premises”
<XmlValueValidationError xmlns:xsd=”http://www.w3.org/2001/XMLSchema” xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”>
<ErrorInfo Resolved=”false” ServiceInstance=”microsoftcommunicationsonline/noam-2a-s7″ Timestamp=”2018-11-16T02:25:02.9241589-08:00″ xmlns=”http://schemas.microsoft.com/online/directoryservices/change/2008/11″>
<ServiceInstance xmlns:xsd=”http://www.w3.org/2001/XMLSchema” xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance” Name=”microsoftcommunicationsonline/noam-2a-s7″ xmlns=”http://schemas.microsoft.com/online/error/
<ErrorDescription>The DNS record lyncdiscover.contoso.com (HostName=lyncdiscover.contoso.com) does not resolve to the Skype for Business Online domain name space. Either update the DNS record to the Skype for
Business Online domain name space to have this user hosted in Skype for Business Online, or remove the Skype for Business license if this user is hosted On Premises. DNS record last queried @ 11/16/2018 10:27:12.</Error
This is actually good news as no Office 365 Admin can now just break Skype for Business Hybrid deployments without realizing, it would just be blocked.