Error upgrading organization to TeamsOnly

A colleague of mine was working on a project with a customer moving from Skype for Business Online to Microsoft Teams. The big day had arrived and it was time to flick the switch.

A few moments after work was scheduled to begin he contacted me saying that the Teams portal would not allow saving the changes after setting the coexistence mode to “Teams only”. I suggested using PowerShell instead and thought that was it.

I was very surprised to hear that an error was received running the following command.

Grant-CsTeamsUpgradePolicy -PolicyName UpgradeToTeams -Global

The error message said the following:

This organization cannot be upgraded to TeamsOnly at the tenant level because there is an on-premise deployment of Skype for Business detected in 1 or more of it sip domains, domain.com. Users can be individually upgraded to TeamsOnly using either Move-CsUser (if the user has an on-premises Skype for Business account) or Grant-CsTeamsUpgradePolicy (if the user is homed in Skype for Business online).

As the on-premise Skype for Business environment was decommissioned years ago knew that the statement simply wasn’t true. Even more surprising, the domain mentioned in the error had never been used in this context. The domain simply existed in Office 365 because of it being a verified domain used for Azure only.

Using PowerShell I verified that there were indeed no users tied to the domain. I started looking into the domain itself and sure enough no services were enabled in O365 and no SfB related DNS records were present. I still went ahead and ran the Skype for Business Autodiscover Web Service test.

Once again, surprise! While the test failed, it showed that lyncdiscover.domain.com had resolved to two IP-addresses that did not respond to further requests. How was this possible given that there were no record with the host of lyncdiscover.domain.com?

Turns out that wildcard a records for *.domain.com in DNS fools Teams into believing that there is an on-premise environment remaining in your organization. Upon enabling the domain for use with Skype for Business Online and adding the appropriate DNS-records, I could run the same PowerShell command without any issues.

In the end the customer is now Teams only. Good stuff!

Leave a Reply

Your email address will not be published. Required fields are marked *