Configuring User Synchronization in Azure AD Connect
Question
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You manage an Active Directory domain named contoso.local.
You install Azure AD Connect and connect to an Azure Active Directory (Azure AD) tenant named contoso.com without syncing any accounts.
You need to ensure that only users who have a UPN suffix of contoso.com in the contoso.local domain sync to Azure AD.
Solution: You use the Synchronization Service Manager to modify the Metaverse Designer tab.
Does this meet the goal?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B.B
Instead use Synchronization Rules Editor to create a synchronization rule.
Note: Filtering what objects are synced to Azure AD is a common request and there are many instances where filtering by OU just doesn't cut it. One option is to filter users by their UPN suffix so that only users with the public FQDN as their UPN suffix are synced to Azure AD (e.g., john.doe@acme.com would be synced while jane.doe@internal.acme.com would not).
Filtering can be configured using either the GUI (Synchronization Rules Editor) or PowerShell.
https://www.sidekicktech.com/blog/field-notes/2019/upn-suffix-filtering-ad-connect/The proposed solution does not meet the goal.
The Metaverse Designer tab in the Synchronization Service Manager is used to define and configure the synchronization rules between the on-premises Active Directory and the Azure AD tenant. However, modifying the Metaverse Designer tab alone does not ensure that only users with a UPN suffix of contoso.com in the contoso.local domain are synced to Azure AD.
To achieve the goal, you need to create and configure a new synchronization rule. Follow these steps:
- Launch the Synchronization Service Manager.
- Create a new inbound synchronization rule.
- Set the scope of the rule to only include users with a UPN suffix of contoso.com.
- Map the appropriate attributes from the on-premises Active Directory to the corresponding attributes in Azure AD.
- Save and run the synchronization rule.
This ensures that only users with a UPN suffix of contoso.com in the contoso.local domain are synced to Azure AD.
