Published: 22/06/2018
Applies to: Cayosoft Administrator 5.x or later.
Summary: In hybrid environments by default all domains and OUs are synchronized with Office 365 by Azure AD Connect tool. If there are some domains or OUs you do not want to synchronize to Azure AD, you can unselect these domains and OUs.
This can be useful when you are using 'PROVISION HYBRID USERS' runbook to avoid race condition when creating users both in AD and in Office 365. During runbook execution, Azure AD Connect may sync new AD users to Office 365, and in this case 'AD Users | Create Office 365 Accounts (Cloud)' rule fails with error that the Office 365 user with same userPrincipalName already exists in the tenant.
To avoid these errors, we recommend to set initial scope of the runbook in OU that is not syncing with Office 365, so users created in AD in the first rule won't appear in Office 365 before rule 'AD Users | Create Office 365 Accounts (Cloud)' execution. And move these users to OU that is syncing with Office only on final step - use 'Text file | DynamicAttributes™ Relocate AD Users' rule in the runbook.
How to exclude OU from AAD Sync in Microsoft Azure Active Directory Connect Tool
You can exclude specific OUs from syncing in Azure AD Connect tool in Custom Settings. To do this, please follow the instructions here: Azure AD Connect: Domain and OU filtering
How to exclude OU from AAD Sync in Synchronization Service Manager tool
If you use OU-based filtering with Azure AD Connect, by default all new OUs added after Azure AD Connect was configured are synchronized. So, if you want the behavior that new OUs should not be synchronized, then you can configure it after the wizard has completed with Synchronization Service Manager. To do this, please follow the instructions from this article: Manage Azure AD Sync: Organizational unit–based filtering
Comments
0 comments
Please sign in to leave a comment.