Hey checkyourlogs.net fans, today’s post covers a common “ask” from those synchronizing on-premises Active Directory with Azure AD: how to prevent certain local objects, specifically users, from synchronizing to Azure AD. Use AD Connect’s filtering capabilities, that’s how! In today’s scenario I’m going to prevent the SystemMailbox account created for Exchange from synchronizing to Azure AD. I’ll set a value on an existing, but unused attribute found on the SystemMailbox AD object, then filter based on that new value. Let’s get this done!
Step one is preventing unwanted synchronization while making changes. Do this by disabling the synchronization scheduled task using PowerShell. Open PowerShell, then run:
Set-ADSyncScheduler -SyncCycleEnabled $False
No output indicates success.
Start Synchronization Rules Editor
Look at list of current rules, identify a Precedence value which ISN’T currently used and is lower than existing values (needed later)
Make sure Inbound is selected, then click Add New Rule.
Give the rule a descriptive name, such as “In from AD – User DoNotSyncFilter”
Enter a description for this connector such as “Local AD users to exclude from synchronization with AzureAD”
Select the local AD forest
Select User as the Connected System Object Type
Select Person as the Metaverse Object Type
Select Join for Link Type
Enter a Precedence value that isn’t currently used by another synchronization rule (identify earlier)
Do NOT change Tag, Enable Password Sync, or Disabled settings
Add a Scoping Filter by clicking Add group
Click Add clause
Drop down the Attribute select box, click the attribute to filter on, such as ExtensionAttribute6. I often use the ExtensionAttributes because they’re already in the schema, but aren’t assigned values. Feel free to extend your schema with a custom attribute if you prefer.
Drop down the Operator select box and click EQUAL
Enter the attribute value to use identifying accounts to filter, such as “LocalOnly”
No need for join rules, click Next
Click Add transformation
Drop down the FlowType select box and click Constant
Drop down the Target Attribute select box and click cloudFiltered
Enter True in Source
Leave Apply Once unchecked
Select Update for Merge Type
Pro tip: The new rule appears at the top of the Synchronization Rules Editor since a lower Precedence value was selected and the Synchronization Rules Editor sorts Precedence low to high by default
Close Synchronization Rules Editor
Open Synchronization Service
Select the Active Directory Domain Services Type Connector
Note the Name of the Windows Azure Active Directory… Type Connector for later use
On the Actions Menu to the right, click Run
Select Full Synchronization
Wait for the Full Synchronization job just started to finish…
With filtering configured and in place, it’s time to reenable to synchronization schedule. Within PowerShell, run:
Set-ADSyncScheduler -SyncCycleEnabled $True
Remember, no output indicates success.
Verify the synchronization schedule is enabled, run:
Get-ADSyncScheduler | Format-List SyncCycleEnabled
Output should show
SyncCycleEnabled : True
That’s it! With this in place, any local AD user object with the ExtensionAttribute6 assigned a value of “LocalOnly” won’t synchronize to Azure AD.
Until next time checkyourlogs.net fans, enjoy your IT adventures!