Hi Johny
Yes we only have one forest here. Our Microsoft Online Services Administrator is an Office 365 Global Administrator, and is also the account admin@domain.onmicrosoft.com. I just created another Global Admin called newadmin@domain.onmicrosoft.com, logged into the site, changed the password, and tried to authenticate with the DirSyncTool, but it also failed.
Cheers
Glenn