OU list incomplete in AAD connect

Hi StefanoC66​,

This occurs when the service account that the Microsoft Azure AD Sync runs under does not have permissions to read that specific organisational unit.

This is the service from my host, where you can see it runs under an account named svcSync:

Here's an organisational unit named Dummy I created where svcSync has been denied access:

And this is AAD Connect not showing the Dummy organisational unit:

Finally, I have removed the "deny" permission shown above and restarted the AAD Connect wizard, which now shows the Dummy organisational unit.

If you look at the permissions on your "missing" organisational unit, you probably won't see a "deny" permission like I've shown above (you might, but I'm betting you won't). It's more likely the case that someone has disabled permissions inheritance and your AAD Connect service account has not been added in with sufficient permissions to read and write to that organisational unit and eligible child objects.

So, what you'd want to do is add your service account to that organisational unit's permissions.

Permissions can vary, so I won't specify what you should add, nor will I suggest re-enabling permissions inheritance (if it is indeed disabled) as there may be a valid reason inheritance has been disabled.

What you will need to achieve is giving that AAD Sync service account the necessary rights to read your missing organisational unit. You may be able to refer to a different organisational unit - or even the topmost domain node - to determine exactly what that access should look like.

Cheers,

Lain