SOLVED

Azure AD Connect: Filtering out local AD users not working

%3CLINGO-SUB%20id%3D%22lingo-sub-1100932%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%3A%20Filtering%20out%20local%20AD%20users%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1100932%22%20slang%3D%22en-US%22%3EDisabling%20the%20account%20won't%20stop%20the%20sync%20by%20default.%3CBR%20%2F%3E%3CBR%20%2F%3EDo%20you%20also%20change%20the%20OU%20of%20the%20account%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1101119%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%3A%20Filtering%20out%20local%20AD%20users%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1101119%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3BWell%2C%20no.%20We%20simply%20disable%20the%20AD%20account.%20And%20with%20this%20sync%20rule%20I%20was%20hoping%20that%20the%20deletion%20would%20not%20be%20replicated%20to%20AAD%20removing%20the%20account%20there%20since%20this%20will%20trigger%20the%20deletion%20of%20the%20user's%20OneDrive%20which%20is%20what%20we%20want%20to%20avoid%20when%20we%20know%20that%20the%20user%20will%20return%20after%20a%20couple%20of%20months.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1101461%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%3A%20Filtering%20out%20local%20AD%20users%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1101461%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F37813%22%20target%3D%22_blank%22%3E%40Florian%20Hein%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20regular%20AD%20Connect%20flow%20is%20as%20follows%3A%3C%2FP%3E%3CP%3E-%20Disable%20account%20in%20AD%3C%2FP%3E%3CP%3E-%20Account%20gets%20disabled%20in%20AAD%2C%20like%20below%3A%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20251px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F164732i922BB179CAA512A9%2Fimage-dimensions%2F251x84%3Fv%3D1.0%22%20width%3D%22251%22%20height%3D%2284%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EIf%20it's%20disabled%2C%20the%20Onedrive%20will%20still%20exist%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOnly%20if%20you%20delete%20the%20account%2C%20will%20the%20account%20be%20deleted%20in%20AzureAD.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20the%20account%20is%20deleted%20in%20AAD%2C%20when%20you%20disable%20the%20account%20in%20local%20AD.%20There%20must%20be%20some%20misconfiguration%20because%20that%20is%20done%20by%20design.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1102280%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%3A%20Filtering%20out%20local%20AD%20users%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1102280%22%20slang%3D%22en-US%22%3E%3CP%3EJust%20to%20confirm%20what%20Thijs%20said%20-%20disabling%20the%20account%20in%20AD%20should%20NOT%20result%20in%20deletion%20of%20the%20corresponding%20Azure%20AD%2FOffice%20365%20account.%20If%20that%20happens%2C%20you%20have%20a%20custom%20rule%20in%20place%20and%20you%20should%20edit%20it%20accordingly%20to%20exclude%20those%20users.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1103465%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%3A%20Filtering%20out%20local%20AD%20users%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1103465%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F37813%22%20target%3D%22_blank%22%3E%40Florian%20Hein%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20purpose%20of%26nbsp%3B%3CSPAN%3E%26nbsp%3Bsetting%20%22cloudFiltered%22%20to%20%22true%22%2C%20is%20to%20disable%20sync%20of%20a%20particular%20Object.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EThis%20rule%20that%20you%20have%20customized%20is%20creating%20issues.%26nbsp%3B%3CBR%20%2F%3EOn-prem%20disable%20account%20will%20never%20get%20deleted%20from%20Azure%20AD%2C%20whereas%20for%20disabled%20accounts%20on%20prem%2C%20%22Block%20Sign%20in%20is%20set%20to%20true%22%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F164906i56737B0852C78BF6%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DcAWgF5QSWcs%26amp%3Blist%3DPL8wOlV8Hv3o8yJgQ-zd6MQs__0jAYDqZ1%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DcAWgF5QSWcs%26amp%3Blist%3DPL8wOlV8Hv3o8yJgQ-zd6MQs__0jAYDqZ1%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1104685%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%3A%20Filtering%20out%20local%20AD%20users%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1104685%22%20slang%3D%22en-US%22%3E%3CP%3EGuys%20thanks%20for%20your%20help.%20I%20spoke%20to%20a%20colleague%20and%20unbeknownst%20to%20me%20with%20the%20disabling%20the%20OU%20was%20also%20changed.%20Can%20this%20be%20configured%20so%20that%20an%20OU%20change%20does%20not%20trigger%20a%20DELETION%20or%20ADD%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1104983%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%3A%20Filtering%20out%20local%20AD%20users%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1104983%22%20slang%3D%22en-US%22%3EIt%20probably%20means%20that%20that%20OU%20isn't%20sync'ed%20to%20Azure%20AD%20so%20you%20should%20add%20that%20in%20the%20custom%20filtering%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fhybrid%2Fhow-to-connect-sync-configure-filtering%23organizational-unitbased-filtering%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fhybrid%2Fhow-to-connect-sync-configure-filtering%23organizational-unitbased-filtering%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1106739%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%3A%20Filtering%20out%20local%20AD%20users%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1106739%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3BGot%20it%2C%20thank%20you!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1112415%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20AD%20Connect%3A%20Filtering%20out%20local%20AD%20users%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1112415%22%20slang%3D%22en-US%22%3EBtw%2C%20the%20deletion%20of%20account%20starts%20deleting%20OneDrive%20after%20retention%20period%20is%20over%2C%20which%20you%20can%20also%20extend%20up%20to%2010%20years.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1100904%22%20slang%3D%22en-US%22%3EAzure%20AD%20Connect%3A%20Filtering%20out%20local%20AD%20users%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1100904%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ewe%20have%20users%20in%20local%20AD%20that%20could%20be%20absent%20for%20a%20while%20and%20we%20have%20to%20disable%20their%20local%20AD%20accouns%20for%20compliance%20reasons.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%2C%20due%20to%20an%20active%20Azure%20AD%20sync%20this%20will%20also%20delete%20their%20account%20in%20Azure%20AD%20%2F%20Office%20365.%20I%20found%20a%20neat%20guide%20how%20to%20exclude%20users%20from%20the%20AD%20-%26gt%3B%20AAD%20sync%20by%20setting%20a%20value%20in%20a%20free%20extensionAttribute%20and%20configuring%20a%20synchronization%20rule%20to%20set%20the%20property%20%22cloudFiltered%22%20to%20true.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20all%20explained%20in%20this%20guide%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.checkyourlogs.net%2F%3Fp%3D66483%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3Ehttps%3A%2F%2Fwww.checkyourlogs.net%2F%3Fp%3D66483%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHowever%2C%20when%20testing%20it%2C%20as%20soon%20as%20I%20set%20the%20extension%20attribute%20and%20perform%20a%20delta%20import%2C%20and%20delta%20sync%20on%20the%20AD%20connector%20in%20the%20AAD%20Synchronization%20Service%20it%20will%20attempt%20to%20completeley%20delete%20the%20persons%20cloud%20object.%20I%20found%20out%20that%20this%20is%20because%20the%20%22ms-DS-ConsistencyGUID%22's%20value%20is%20removed.%20I%20can't%20figure%20out%20why%20that%20synchronization%20rules%20causes%20this%20to%20occurr.%20I%20verified%20that%20it%20must%20be%20this%20rule%20since%20I%20can%20change%20any%20other%20attribute%20of%20the%20person%20object%20and%20it%20will%20update%20properly.%20Only%20when%20I%20populate%20the%20extensionAttribute%20configured%20in%20the%20sync%20rule%20will%20the%20rmoval%20of%20the%26nbsp%3B%22ms-DS-ConsistencyGUID%22's%20value%20be%20triggered.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20ideas%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1100904%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%20Connect%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Deleted
Not applicable

Hello,

 

we have users in local AD that could be absent for a while and we have to disable their local AD accouns for compliance reasons.

 

Now, due to an active Azure AD sync this will also delete their account in Azure AD / Office 365. I found a neat guide how to exclude users from the AD -> AAD sync by setting a value in a free extensionAttribute and configuring a synchronization rule to set the property "cloudFiltered" to true.

 

This is all explained in this guide https://www.checkyourlogs.net/?p=66483

 

However, when testing it, as soon as I set the extension attribute and perform a delta import, and delta sync on the AD connector in the AAD Synchronization Service it will attempt to completeley delete the persons cloud object. I found out that this is because the "ms-DS-ConsistencyGUID"'s value is removed. I can't figure out why that synchronization rules causes this to occurr. I verified that it must be this rule since I can change any other attribute of the person object and it will update properly. Only when I populate the extensionAttribute configured in the sync rule will the rmoval of the "ms-DS-ConsistencyGUID"'s value be triggered.

 

Any ideas?

 

Thanks.

9 Replies
Disabling the account won't stop the sync by default.

Do you also change the OU of the account?

@Thijs Lecomte Well, no. We simply disable the AD account. And with this sync rule I was hoping that the deletion would not be replicated to AAD removing the account there since this will trigger the deletion of the user's OneDrive which is what we want to avoid when we know that the user will return after a couple of months.

best response
Solution

@Deleted 

 

The regular AD Connect flow is as follows:

- Disable account in AD

- Account gets disabled in AAD, like below:

clipboard_image_0.png

If it's disabled, the Onedrive will still exist

 

Only if you delete the account, will the account be deleted in AzureAD.

 

If the account is deleted in AAD, when you disable the account in local AD. There must be some misconfiguration because that is done by design.

 

Just to confirm what Thijs said - disabling the account in AD should NOT result in deletion of the corresponding Azure AD/Office 365 account. If that happens, you have a custom rule in place and you should edit it accordingly to exclude those users.

@Deleted 

The purpose of  setting "cloudFiltered" to "true", is to disable sync of a particular Object.

This rule that you have customized is creating issues. 
On-prem disable account will never get deleted from Azure AD, whereas for disabled accounts on prem, "Block Sign in is set to true"

clipboard_image_0.png

https://www.youtube.com/watch?v=cAWgF5QSWcs&list=PL8wOlV8Hv3o8yJgQ-zd6MQs__0jAYDqZ1

Guys thanks for your help. I spoke to a colleague and unbeknownst to me with the disabling the OU was also changed. Can this be configured so that an OU change does not trigger a DELETION or ADD?

 

Thanks.

It probably means that that OU isn't sync'ed to Azure AD so you should add that in the custom filtering: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filteri...
Btw, the deletion of account starts deleting OneDrive after retention period is over, which you can also extend up to 10 years.