AADconnect, do not sync unknown suffix to default domain in O365

Ben Wosjke 136 Reputation points
2020-05-15T14:34:52.527+00:00

take the following config

  • On premise AD domain with a UPN suffix of AD.Local
  • UPN suffix is added for AD.com
  • Some users are set to use AD.com as their UPN suffix, others are left at AD.local
  • O365 is configured with a verified doamin of AD.com and the default domain of ad.onmicrosoft.com

in early builds of AADConnect, only accounts with update UPN's of AD,com would be sync'ed.
Now (im not sure exactly when this changed), an account that has AD.local as its UX suffix will be sync'ed and get the default domain suffix in O365... so AD.com

I've searched everywhere i can think of - but i cant find a way to turn this off. We only want accounts with the correct UPN suffix to be sync'ed.... if the UPN suffix is not one matched in O365 - dont sync the account.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,087 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thierry DEMAN-BARCELO 491 Reputation points MVP
    2020-05-15T14:49:24.91+00:00

    Hello @Ben Wosjke ,

    since the first version of ADConnect, all accounts with a not verified domain are synchronized and defined with the default .onMicrosoft.com.

    I suppose that a specific rule was done to filter only accounts with the correct domain, or perhaps only Organizational units with accounts well formed were synchronized.

    Probably one of these filters have been lost after an update or a reinstallation of ADConnect. Sample of filtering are indicated in this page.

    https://video2.skills-academy.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering

    In your case, you should use attribute filtering on " userPrincipalName" using the operator "ENDSWITH" with the value "@AD.COM".

    Regards,

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.