Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Disabling Synchronization Rule - Out to AD – User NGCKey in AzureAD Connect.

Copper Contributor

I have an on-premise deployment of Windows Hello for business [Certificate Trust] using ADFS 4.0 DRS.

I also have an O365 Apps for Enterprise (Pro-plus) subscription.

The identities (users only) are synced from on-premise to Azure AD. 

Only 8 attributes (Required for O365 Pro-plus is synced), [App Filtering in used]


accountEnabled
cn
displayName
objectSID
pwdLastSet
samAccountName
sourceAnchor
usageLocation
userPrincipalName

 

No device/group write-back is enabled, no other O365 applications are used.

I am seeing plenty of errors like ones mentioned in blog below (Q4) in Synchronization Service , where the service is trying to overwrite/remove the msds-keycredentialLink attribute [Populated to due WH4B provisoning] for insufficient permissions. 

 

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-mailbag-windows-hell...

 

They should be triggered by the synchronization rules listed below

.

IN from AAD - User NGCKey (to DeviceKey in mv)

Out to AD – User NGCKey (from DeviceKey in mv to msds-keycredentialLink in AD)

 

My questions,

 

1. Why does it need to writeback the NGCkey ?

2. Why the errors still persists even if the below rules are disabled ?

 

 

 

0 Replies