Jun 25 2018 10:57 PM - edited Jun 25 2018 10:58 PM
Hello
There's a lot of guidelines for various O365 workloads and Tenant settings - but havn't found any for "Designing an AD structure" guidelines regarding AD Connect and the use of filtering -
Is your (complete) AD synced to AAD (service accounts etc etc. ? -
or did you create a specific OU where you have 'categorized' your users in security groups and used the filtering before sync?
- what are the 'recommendations' from MS ?
Jun 26 2018 12:17 AM
Filtering is an optional feature, which you should only use when needed. There's negligible security impact of syncing your objects to Azure AD, and adjusting the OUs/objects to sync will hardly remedy any bad decisions implemented back when the AD was designed.
You can think of the default configuration as Microsoft's recommendation, as mentioned here: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-conf...
Jun 26 2018 12:32 AM
Hi Vasil
Thanks for your reply :)
So when MS guidelines says "Categorize your users" and "Use groups and group-based licensing" - and we have the AD administration "on prem" only - what to do then? .... the complete AD synced out - are 'just' to have the global address List available or am I missing something?.
Jun 26 2018 10:44 AM
It's up to you really, I've seen organizations going either way. We certainly have more than enough settings to configure filtering now, so you can use it if you thinks it's best for your particular org. The closest think I could find to a "recommendation" is in the article I linked above :)
Jun 26 2018 11:39 AM
Some reasons to not sync service accounts include:
1. they provide an additional risk to the organization if they get compromised in the cloud.
2. they show up in Delve and other places, which can be confusing/ugly
Jun 26 2018 11:43 AM