need to clean up Federated domain

Venugopal B 21 Reputation points
2020-09-16T09:44:30.453+00:00

Hi Members,

Good day,

We have a federated domain in Azure. -> eg. fed.dom.lo.com

the AD Connect was set up and it had synchronized all the users in our on-prem domain controller to the Azure.

Assume we had 20k users in the specific OU, which was set for the sync. Now, the change that came in would want us to sync users which have a specific attribute set.

ie, departmentName = xyz and not all.

My doubts are as below,

1.What would happen to the existing users in Azure federated domain, would there be a clean up automatically done? ex, users synced are 20k, but users with attribute are just 3k.

2.How would we do a clean up on Azure domain?

  1. Could we delete all the users on Azure domain and add the inbound sync rule to have the limited users show up again?

or any better way to achieve this.

Thank you

V

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,247 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,372 questions
0 comments
Accepted answer
  1. VipulSparsh-MSFT 16,271 Reputation points Microsoft Employee
    2020-09-17T04:57:09.473+00:00

    @Venugopal B Thanks for reaching out. Please find the answers inline.

    1) .What would happen to the existing users in Azure federated domain, would there be a clean up automatically done? ex, users synced are 20k, but users with attribute are just 3k.

    VS : There are 2 level of filtering which you can do to achieve your Goal.
    a) OU level filtering : You can create a separate OU for all those 3k users which will have the Department attribute filled. And select only this OU for sync scope, this way these 3k users will still sync up but rest all will get deleted. And as suggested by Andy, you would need to use https://video2.skills-academy.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-feature-prevent-accidental-deletes to be able to delete more objects than 500.

    b) Attribute level filtering : You can create a new rule and specify that users with department attribute for eg "Sales" or "IT" should sync up but not anyone else.

    25346-syncrule.png

    This require a little more work as this needs to be carefully created and at the same time you will have to disable other sync rules which might be syncing the users.
    This is also called Positive Filtering and you can read more about it here : https://video2.skills-academy.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-
    configure-filtering#positive-filtering-only-sync-these

    If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.

    1 person found this answer helpful.

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 147.6K Reputation points MVP
    2020-09-16T12:01:28.427+00:00

    Yes, the objects in Azure will be deleted if you remove that OU from the sync and the new ones will be added.
    However, there is a maximum of 500 deleted objects allowed per sync. If you want AADConnect to delete all 20,000 objects, then follow the article below:

    https://video2.skills-academy.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-feature-prevent-accidental-deletes

    The default value of 500 objects can be changed with PowerShell using Enable-ADSyncExportDeletionThreshold, which is part of the AD Sync module installed with Azure Active Directory Connect. You should configure this value to fit the size of your organization. Since the sync scheduler runs every 30 minutes, the value is the number of deletes seen within 30 minutes.

    2 people found this answer helpful.
    0 comments
  2. Venugopal B 21 Reputation points
    2020-09-22T11:48:50.743+00:00

    Thank you anonymous userDavid @VipulSparsh-MSFT : I would choose Positive Filtering

    1.We do not have a separate OU for these users.
    2. We have only one OU, that contains all the users.

    I would update once we are good with the steps.

    Thank you for your time and support.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.