So, what happened?ĪADConnect now has an INBOUND rule that when the attribute “adminDescription” in Active Directory has a value set with a prefix of User_ or Group_, it will filter out and not sync that into the metaverse.Īn example to use would be: “User_DoNotSync” or “Group_DoNotSync”.

This customer upgraded Azure AD Connect and found a fault with their custom rule. I came about this when working on a clients site who was using the attribute “adminDescription” for a custom purpose. Change in Azure AD ConnectĪ few months back though, an update to Azure AD Connect added this user based filter functionality “out of the box”. Often required when group based or organisational unit filtering is hard to maintain due to large data object counts. This is most certainly handy when you have multiple forests synced with Azure AD and want to filter out a user that has a secondary account in your second forest. This process usually went along the lines of: if the attribute contained the word or phrase like “DoNotSync”, it would filter this user out. In numerous customer sites that I’ve worked with, or even deployed AADConnect, a handy filter was also to create a manual filter based on a CustomAttribute or CustomExtensionAttribute. – – outlines this and explains the various methods available to filter out objects. The Microsoft Azure documentation page – – Add in a value with a prefix of User_ or Group_ to filter out that objectĪzure AD Connect, like previous version of the directory synchronisation application, is able filter users, groups or contacts that are synchronised to Azure AD / Office 365 through a number of methods.Leverages ADDS attribute: adminDescription.Really? I need to shorten an already short post? Well, you’re welcome Generation-Y.

Azure ad admin login