Archives September 2022

Another customization option available involves mapping attribute values between on-premises and cloud objects. As with Azure AD Connect, you can configure how cloud attributes are populated—whether it’s from a source attribute, a constant value, or some sort of expression.

Azure AD Connect sync comes with a default attribute mapping flow, as shown in Figure 4.33:

Figure 4.33 – Azure AD Connect Cloud Sync attribute mappings

You can select an existing attribute to modify or create a new attribute flow. One of the basic configuration features for most attributes is to configure a Default value (if the on-premises value is blank), allowing you to make certain that cloud attributes are populated with values.

In Figure 4.34, the Country attribute has been selected and updated with the default value US. This ensures that in the event a user’s on-premises country attribute is blank, the corresponding cloud attribute will be populated with a valid entry.

Figure 4.34 – Edit attribute mappings in Azure AD Connect Cloud Sync

Azure AD Connect Cloud Sync also features an expression builder, allowing you to create your own custom attribute flows.

Unlike Azure AD Connect, however, attribute mappings and expressions cannot be used to merge attributes from different domains or forests, nor does Azure AD Connect Cloud Sync support synchronization rules or attribute flow precedence. If you require that level of customization, you should deploy Azure AD Connect instead.

Once you have finished customizing the scoping filters and attribute flows, you can return to the Overview page and enable synchronization by selecting Review and enable.

Troubleshooting Azure AD Connect Cloud Sync Synchronization

Just as Azure AD Connect may experience issues with synchronizing identity, Azure AD Connect Cloud Sync can as well. Successful synchronization depends on several factors:

• Agent functionality: Is the agent installed and functioning normally?

• Network communications: Can the agent reach all of the required endpoints and resolve DNS for Azure AD services?

• Service account issues: Does the service account have the appropriate rights to the on-premises objects?

When troubleshooting the Azure AD Connect Cloud Sync service, you should start with the Windows Event Viewer to determine whether there are any errors related to the service, such as invalid credentials or missing privileges.

While Microsoft generally recommends bypassing proxy and content filtering services for Microsoft 365 endpoints, your organization may still choose to deploy them. In the event that the server for the Azure AD Connect Cloud Sync agent is located behind a proxy server or appliance, it may become necessary to modify the service configuration file with the proxy’s information.

The Azure AD Connect Cloud Sync provisioning agent utilizes a configuration file stored in

C:\Program Files\Microsoft Azure AD Connect Provisioning Agent\ AADConnectProvisioningAgent.exe.config. To add proxy configuration information, edit this file, and before the closing </configuration> tag, enter the following data (replacing

[proxy-server] and [proxy-port]) with the proxy server or appliance address and network port:

<system.net><defaultProxyenabled=”true”useDefaultCredentials=”true”><proxyusesystemdefault=”true”proxyaddress=”http://[proxy-server]:[proxy-port]”bypassonlocal=”true”/></defaultProxy></system.net>

If you need to perform deeper troubleshooting for the agent, you can install the AADCloudSyncTools PowerShell module. The AADCloudSyncTools module has a number of functions in it for configuringand gathering verbose logging data, configuring the sync schedule, and repairing the service account. For more information on the functions supported by the cmdlet, see https://learn.microsoft.com/ en-us/azure/active-directory/hybrid/cloud-sync/reference-powershell.

If you need to exclude objects from Azure AD Connect’s synchronization scope, you can do that through a number of different methods:

• Domain and organizational unit-based filtering

• Group-based filtering

• Attribute-based filtering

Let’s quickly examine these.

Domain and Organizational Unit-Based Filtering

With this method, you can deselect large portions of your directory by modifying the list of domains or organizational units that are selected for synchronization. While there are several ways to do this, the easiest way is through the Azure AD Connect setup and configuration tool:

1.To launch the Azure AD Connect configuration tool, double-click the Azure AD Connect icon on the desktop of the server where Azure AD Connect is installed. After it launches, click Configure.

2. On the Additional tasks page, as shown in Figure 4.8, select Customize synchronization options and then click Next.

Figure 4.8 – Additional tasks page

3. On the Connect to Azure AD page, enter credentials for either the Global Administrator or Hybrid Identity Administrator role and click Next.

4. On the Connect your directories page, click Next.

5. On the Domain and OU filtering page, as shown in Figure 4.9, select the Sync selected domains and OUs radio button and then select or clear objects to include or exclude from synchronization.

Figure 4.9 – Azure AD Connect Domain and OU filtering page

6. Click Next.

7. On the Optional features page, click Next.

8. On the Ready to configure page, click Configure.

After synchronization is completed, verify that only objects from in-scope organizational units or domains are present in Azure Active Directory.

Group-Based Filtering

Azure AD Connect only supports the configuration of group-based filtering if you choose to customize the Azure AD Connect setup. Group-based filtering is not available if you perform an express installation.

If you’ve chosen a custom installation, you can choose to limit the synchronization scope to a single group. On the Filter users and devices page of the configuration wizard, select the default radio button, Synchronize all users and devices, to continue without group filtering. You can also choose the Synchronize selected radio button and then enter the name or distinguishedName (DN) of a group that contains the users and devices to be synchronized.

Figure 4.10 – Filter users and devices page

With group-based filtering, only direct members of the group are synchronized. Users, groups, contacts, or devices nested inside other groups are not resolved or synchronized.

Note

Microsoft recommends group-based filtering for piloting purposes only.