edsvaAzureOffice365Enabled is not present on a Container object (4338819)

By default, the edsvaAzureOffice365Enabled Virtual Attribute is not extended to Container class objects.

STATUS 

This is by design, following Microsoft's best practices as outlined here:

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/delegating-administration-of-default-containers-and-ous

WORKAROUND

In the event that there are non-default Container objects in your environment, the following workaround can be completed to allow Azure object creation within them.

It is recommended to not perform this on the default Active Directory Containers such as Users, BuiltIn, Computers, etc.

1. In the Active Roles Console, as an Active Roles Admin, expand Configuration/Server Configuration/Virtual Attributes
2. Find the EDSVA-Azure-Office365-Enabled Virtual Attribute and double-click on it
3. On the Classes tab, check off Container and then Apply | OK
4. Reconnect in the Active Roles Console and perform an IISRESET in the Active Roles Web Interface so that the schema change is detected
5. The edsvaAzureOffice365Enabled Virtual Attribute is present on the Container object. Set the value to TRUE and link the necessary Azure Policy, and it will be possible to Azure-enable objects in that container.