{"id":1064,"date":"2019-12-16T22:48:03","date_gmt":"2019-12-16T22:48:03","guid":{"rendered":"http:\/\/pingalasolutions-com.preview-domain.com\/?p=1064"},"modified":"2023-01-17T20:35:30","modified_gmt":"2023-01-18T01:35:30","slug":"aadconnect-attribute-based-filtering","status":"publish","type":"post","link":"https:\/\/www.pingalasolutions.com\/?p=1064","title":{"rendered":"AADConnect: Attribute-based Filtering"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\nAs a hands-on practice area lead, I get to deliver projects both directly as an architect, and indirectly as an Engagement Manger. In one recent project, one of my Higher Ed clients wanted to setup attribute-based filtering. The matter got escalated to me and I helped the client in setting this up. I documented the process to my client and thought there may be others who may find this helpful as well.<\/span>\r\n\r\n<\/div>\r\n
In this article I will not be going into what\u00a0AADConnect<\/span>\u00a0is and how to deploy the same. I will assume that you already know about\u00a0AADConnect<\/span>\u00a0and possibly have deployed the same as well.<\/div>\r\n
One of the features of\u00a0AADConnect<\/span>\u00a0is the ability to filter objects that are synched to Azure AD. The default and the recommended configuration are to sync all objects in all domains in the configured forest. There are cases, however, that requires us to filter the objects to be synched.\u00a0AADConnect<\/span>\u00a0provides the following filtering options: Group-based, Domain-based, OU-based, and Attribute-based. It is possible to use multiple filtering options at the same time. For more information, check out:\u00a0https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/hybrid\/how-to-connect-sync-configure-filtering<\/a>. Rest of this article will focus on Attribute based filtering, where, I am mostly documenting the steps to go about configuring attribute -based filtering. However, what I found during my interaction with the client, that giving a brief background about the architecture helped to ease the transition. So I start with a synopsis of the architecture below, I highly recommend you to dig deeper with:\u00a0https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/hybrid\/concept-azure-ad-connect-sync-architecture<\/a><\/div>\r\n
Connected Directories (CD)<\/b>: Data repositories that are synchronized by\u00a0AADConenct<\/span>. There is a source CD and a target CD. Target CD is always Azure AD. The source CD can be sources as SQL server, AD. Most often, source CD is the on-premises Active Directory (AD).<\/div>\r\n
Connector<\/b>: A module that encapsulates all interaction between CD and\u00a0AADConnect<\/span>. Each type of CD has its own Connector. If you have a custom CD, then it is possible to create a custom Connector, using extensible connectivity framework.<\/div>\r\n
Metaverse<\/b>: There is a Metaverse between the source CD and the target CD that contains the aggregated view of the staging objects. We make use of the available extensible schema to map the objects from the CDs to the objects in the Metaverse. While the handshake is slightly more complex, I found it easier to explain, as the objects from the source CD (on-premises AD), are \u201cImported\u201d into the Metaverse and objects in the Metaverse, are \u201cExported\u201d into the target CD (Azure AD).<\/div>\r\n
During both import and export, the data from the source can be filtered, transformed, and computed values can be injected. Making changes during the export is not recommended, however.<\/div>\r\n
The Import (Inbound) and Export (Outbound) itself is a process that takes the objects through pipeline of modules. The pipeline consists of: Source (On-premises AD in case of Import and Metaverse in case of Export), Scope module,\u00a0Join<\/span>\u00a0module, Transform module, Precedence module, and Target (Metaverse in case of Import and Azure AD in case of Export).<\/div>\r\n
Scope<\/b>: Scope module evaluates an object and determines the rules that are in scope. Scope is defined in Groups and groups contain Clauses. There is a logical OR between the Groups and a logical AND between the Clauses.<\/div>\r\n
Join<\/b>: The Join module in the sync pipeline is responsible for finding the relationship between the object in the source and an object in the target. On Import, this would be an object in in the source (on-premises AD) and finding a relationship to an object in the metaverse.<\/div>\r\n
The joins are defined as one or more groups. Inside a group, you have clauses. A logical AND is used between all clauses in a group. A logical OR is used between groups. The groups are processed in order from top to bottom. When one group has found exactly one match with an object in the target, then no other join rules are evaluated. If zero or more than one object is found, processing continues to the next group of rules. For this reason, the rules should be created in the order of most explicit first and fuzzier at the end.<\/div>\r\n
Transform<\/b>: The Transform module provided the ability to alter the value of an attribute or allow to go directly to the target. Flow types include: Direct (attribute value passed as is), Constant (inject a constant value), Expression (compute the value). Check out\u00a0\u201c<\/span>understanding declarative provisioning expression language<\/span><\/a>\u201d\u00a0for the details for the expression language.<\/span><\/div>\r\n
Precedence<\/b>: In case there are several rules that modifies the same attribute value in the target, the Precedence is used to resolve the conflict. The rule with the highest Precedence (lowest numerical value) will affect the attribute over all other rules.<\/div>\r\n
With that as a short background, let us continue onto the configuration for the attribute-based filtering.<\/div>\r\n
<\/div>\r\n
Configuring Attribute Based Filtering:<\/b><\/div>\r\n
Attribute based filtering provides great control over which objects gets synched to Azure AD by filtering objects based on their attributes. This document walks through setting up such filtering, using AD extension attribute and\u00a0msDS-cloudExtensionAttribute1.<\/div>\r\n
NOTE: While attribute-based filtering gives great control, it can also cause unexpected results, as the rules could affect more than what it was intended for. Be careful while setting up AD synchronization and filtering based on the attribute.<\/div>\r\n
NOTE: The following instruction walks through negative filtering, where all objects in scope will be synched, except for those that meet the rule criteria, and so are filtered out.<\/div>\r\n
Positive filtering on the other hand, will sync only those objects that meet the criteria and filter out everything else. This could be more complex to create, and can have adverse effect on the synchronized objects, so positive filtering will not be discussed in this document.<\/div>\r\n
<\/div>\r\n
The following steps will use\u00a0msDS-cloudExtensionAttribute1<\/b>\u00a0for filtering:<\/div>\r\n
1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>AD Updates<\/b>:<\/div>\r\n
Following needs to be in AD before using the attribute for filtering. Skip if any of these has already been completed. (The AD Updates instruction can also be skipped if one of the well-known attributes, as department, is used for filtering).<\/div>\r\n
a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Mounting AD Schema<\/b><\/div>\r\n
Launch a Command Prompt window as an administrator and run the following:<\/div>\r\n
RegSvr32 schmmgmt.dll<\/div>\r\n
You should get a prompt indicating the schema is mounted.<\/div>\r\n
b.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Creating \/ assigning custom attribute<\/b><\/div>\r\n
Open MMC Console as an administrator.<\/div>\r\n
File -> Add\/Remove snap-in.<\/div>\r\n
Add “Active Directory Schema” from the available snap-ins.<\/div>\r\n
Select OK to complete the Add-In selection.<\/div>\r\n
<\/div>\r\n
Select “Attributes” under “Active Directory Schema” and ensure that the msDS-cloudExtensionAttribute1 exists in the schema.<\/div>\r\n
If the attribute does not exist, select \u201cAdd\u201d and add the attribute to the schema.<\/div>\r\n
c.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Adding the attribute to the user object (and\/or group\/OU) class<\/b><\/div>\r\n
Select Classes in the Add-In.<\/div>\r\n
Scroll the right pane till “user” (or group, or\u00a0organizationalUnit<\/span>).<\/div>\r\n
Double click to open the properties screen.<\/div>\r\n
Ensure that the attribute msDS-cloudExtensionAttribute1 does not exist under the “Optional” box.<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
Select “Add” to open the schema object selector screen.<\/div>\r\n
Select msDS-cloudExtensionAttribute1 and select “OK” button.<\/div>\r\n
<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
Select “Apply” and “OK” in the properties screen.<\/div>\r\n
Repeat the above for other objects (group,\u00a0ou<\/span>\u00a0etc.,) that you want to add the extended attribute.<\/div>\r\n
d.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Restarting AD Domain service<\/b><\/div>\r\n
After all the attributes are added, restart the “Active Directory Domain Services”.<\/div>\r\n
e.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Confirming changes<\/b><\/div>\r\n
Confirm the changes by going to “Active Directory Users and Computers”, selecting a user, and validating that the added attribute is displayed.<\/div>\r\n
Tip: To display the “Attribute Editor” tab, select “Advanced Features” from the View menu.<\/div>\r\n
f.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Populate attribute value<\/b><\/div>\r\n
You can use the editor or PowerShell to populate the attribute value.<\/div>\r\n
Set the value to 1 for those objects that need to be synched, and 0 to those that should be filtered out.<\/div>\r\n
2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Stop the Sync cycle<\/b><\/div>\r\n
a.\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>RDP into the server running\u00a0AADConnect<\/span>\u00a0service.<\/div>\r\n
b.\u00a0 \u00a0 \u00a0<\/span>Launch PowerShell as an administrator and disable the sync by running the following:<\/div>\r\n
Set-ADSyncScheduler<\/span>\u00a0–SyncCycleEnabled<\/span>\u00a0$False<\/div>\r\n
3.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Azure AD Connect \u2013 attributes update<\/b><\/div>\r\n
a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Launch “Azure AD Connect” as an administrator.<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
b.\u00a0 \u00a0 \u00a0<\/span>Select “Configure”.<\/div>\r\n
c.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select “Customization Options”.<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
d.\u00a0 \u00a0 \u00a0<\/span>Provide Office 365 Global admin UID and PWD, and connect to Azure AD.<\/div>\r\n
e.\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select “Next” to skip “Connect your directories”.<\/div>\r\n
f.\u00a0 \u00a0 \u00a0 \u00a0<\/span>Select “Next” to skip “Domain and OU filtering”.<\/div>\r\n
g.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select “Directory extension attribute sync” and select “Next”.<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
h.\u00a0 \u00a0 \u00a0<\/span>In “Directory extensions”, under “Available Attributes”, select the attributes created\/added\u00a0 in AD and move them to the “Selected Attributes” section.<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
i.\u00a0 \u00a0 \u00a0 \u00a0<\/span>Select “Next” and complete the configuration. Note that it may take several minutes to complete the configuration.<\/div>\r\n
4.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Sync Connector updates:<\/b><\/div>\r\n
a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Launch the “Synchronization Service”.<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
b.\u00a0 \u00a0 \u00a0<\/span>Select the “connectors” tab.<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
c.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select the “AD Domain services\u201d connector.<\/div>\r\n
d.\u00a0 \u00a0 \u00a0<\/span>From the “Actions” select “Refresh Schema”, provide UID\/PWD, and update the schema.<\/div>\r\n
e.\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Once \u201cupdate schema\u201d successfully completes, select “Properties” for the same connector.<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
f.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\u201cSelect Attributes\u201d and ensure that the attribute does show up for the connector (msDS-cloudExtensionAttribute1).<\/div>\r\n
g.\u00a0 \u00a0 \u00a0\u00a0<\/span>Select the attribute and “OK” to add the attribute to the connector.<\/div>\r\n
h.\u00a0 \u00a0 \u00a0<\/span>The Extension Attributes should have been added by default for the “Windows Azure Active Directory” connector. Validate the same by selecting the connector and then selecting the properties, and attributes.<\/div>\r\n
5.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Creating the rules:<\/b><\/div>\r\n
a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Launch “Synchronization Rules Editor”.<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n
<\/div>\r\n
<\/a><\/div>\r\n
<\/div>\r\n \r\n\r\n<\/div>\r\n
<\/div>\r\n
<\/div>\r\n
b.\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Create the rule to filter the users:<\/b><\/div>\r\n
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/span>i.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Create a new rule with the following as the values:<\/div>\r\n
Direction: Inbound<\/div>\r\n
Name: In from AD –\u00a0UserDoNotSyncFilter<\/span><\/div>\r\n
Description: Filter users who have msds-CloudExtensionAttribute1 set to 0<\/div>\r\n
Connected system: <Select the connector to local AD><\/div>\r\n
Connected system object type: user<\/div>\r\n
Metaverse object type: person<\/div>\r\n
Link type: Join<\/div>\r\n
Precedence: 201<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
<\/div>\r\n
<\/div>\r\n
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<\/span>ii.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select “Next”.<\/div>\r\n
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/span>iii.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>For the “Scoping filter”, select \u201cAdd Group\u201d and “Add clause” and add the following:<\/div>\r\n
Attribute: msDS-cloudExtensionAttribute1<\/div>\r\n
Operator: EQUAL<\/div>\r\n
Value: 0<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
<\/div>\r\n
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<\/span>iv.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select “Next”.<\/div>\r\n
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/span>v.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Skip the “Join rules” by selecting “Next”.<\/div>\r\n
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/span>vi.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>For the \u201cTransformations\u201d, select “Add transformations” with the following values:<\/div>\r\n
FlowType<\/span>: Constant<\/div>\r\n
Target Attribute:\u00a0cloudFiltered<\/span><\/div>\r\n
Source: True<\/div>\r\n
Merge Type: Update<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
<\/div>\r\n
<\/div>\r\n
\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>vii.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select Add\/Save to complete the rule.<\/div>\r\n
c.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>To create a rule to filter the group:<\/b><\/div>\r\n
Follow the instructions for setting the “user” filtering as above with the following changes:<\/div>\r\n
Connected system object type: group<\/div>\r\n
Metaverse Object type: group<\/div>\r\n
Precedence: 202<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
Complete rest of the configuration as above.<\/div>\r\n
<\/div>\r\n
d.\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>To create a rule to filter the OU:<\/b><\/div>\r\n
Follow the instructions for setting the “user” filtering as above and select:<\/div>\r\n
Connected system object type:\u00a0organizationalUnit<\/span><\/div>\r\n
Metaverse Object type: person<\/div>\r\n
Precedence: 203<\/div>\r\n
\r\n
<\/a><\/div>\r\n \r\n\r\n<\/div>\r\n
<\/div>\r\n
6.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Run a full synchronization:<\/b><\/div>\r\n
a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Back in the “Synchronization Service”.<\/div>\r\n
b.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select the connector to the “Active Directory Domain Services”.<\/div>\r\n
c.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select “Run” and select “Full Synchronization”.<\/div>\r\n
<\/div>\r\n
\r\n
<\/a><\/div>\r\n
<\/div>\r\n \r\n\r\n<\/div>\r\n
d.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select “OK”.<\/div>\r\n
e.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>When the synchronization is complete, there should not be any errors.<\/div>\r\n
7.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Start a sync to Azure AD (Only if there are no errors in the previous step):<\/b><\/div>\r\n
a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>From PowerShell command window, run the following command:<\/div>\r\n
Start-ADSyncSyncCycle<\/span>\u00a0–PolicyType<\/span>\u00a0Initial<\/div>\r\n
8.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Validate the changes in Azure AD:<\/b><\/div>\r\n
a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Once the synchronization is complete, the objects should be filtered out of Azure AD.<\/div>\r\n
b.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Validate the same in Azure AD Portal.<\/div>\r\n
9.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/b>Turn on the synchronization cycle:<\/b><\/div>\r\n
a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>In the PowerShell window type and run the following:<\/div>\r\n
Set-ADSyncScheduler<\/span>\u00a0–SyncCycleEnabled<\/span>\u00a0$True<\/div>\r\n
<\/div>\r\n
A word of caution, that, in my case I had the benefit of working on a system that was not yet synchronized. That made it easier to run the full sync and check the Sync Service and Azure AD for the effectiveness of the rules that I put in. If you have an established\u00a0AADConnect<\/span>, you may want to be a little more careful and \u201cApply and Verify\u201d the changes before you run the full sync as in step 6 above. To verify the changes, follow the steps below before doing #6 above.<\/div>\r\n
<\/div>\r\n
1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Start\u00a0\u201cSynchronization Service\u201d\u00a0from the\u00a0Start<\/b>\u00a0menu.<\/div>\r\n
\r\n\r\n2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select\u00a0Connectors<\/b>. In the\u00a0Connectors<\/b>\u00a0list, select the Connector where you made a configuration change earlier. In\u00a0Actions<\/b>, select\u00a0Run<\/b>.\r\n
<\/a><\/div>\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n\r\n<\/span>\r\n\r\n<\/span>\r\n3.<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>In\u00a0<\/span>Run profiles<\/b>, select the operation that was mentioned in the previous section. If you need to run two actions, run the second after the first one has finished. (The\u00a0<\/span>State<\/b>\u00a0column is\u00a0<\/span>Idle<\/b>\u00a0for the selected connector.)<\/span>\r\n\r\n<\/div>\r\n
<\/div>\r\n
After the synchronization, all changes are staged to be exported. Before you\u00a0actually make<\/span>\u00a0the changes in Azure AD, you want to verify that all these changes are correct.<\/span><\/div>\r\n
1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Start a command prompt and go to\u00a0\u00a0%Program Files%\\Microsoft Azure AD Sync\\bin.<\/div>\r\n
\r\n\r\n2.<\/span>\u00a0 \u00a0 \u00a0 <\/span>Run\u00a0<\/span>csexport “Name of Connector” %temp%\\export.xml \/f:x.<\/span><\/span>\r\n
\u00a0 \u00a0 \u00a0 \u00a0The name of the Connector is in Synchronization Service. It has a name\u00a0similar to<\/span>\u00a0“contoso.com \u2013 AAD” for Azure AD.<\/div>\r\n<\/div>\r\n
3.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Run CSExportAnalyzer %temp%\\export.xml > %temp%\\export.csv<\/div>\r\n
4.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>You now have a file in %temp% named export.csv that can be examined in Microsoft Excel. This file contains all the changes that are about to be exported.<\/div>\r\n
5.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Make the necessary changes to the data or configuration, and run these steps again (Import, Synchronize, and Verify) until the changes that are about to be exported are what you expect.<\/div>\r\n
When you’re satisfied, export the changes to Azure AD.<\/span><\/div>\r\n
1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>Select\u00a0Connectors<\/strong>. In the\u00a0Connectors<\/strong>\u00a0list, select the Azure AD Connector. In\u00a0Actions<\/strong>, select\u00a0Run<\/strong>.<\/div>\r\n
2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>In\u00a0Run profiles<\/strong>, select\u00a0Export<\/strong>.<\/div>\r\n
3.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>If your configuration changes delete many objects, then you see an error in the export when the number is more than the configured threshold (by default 500). If you see this error, then you need to temporarily disable the “prevent accidental deletes<\/a>” feature.<\/div>\r\n
<\/div>\r\n<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

As a hands-on practice area lead, I get to deliver projects both directly as an architect, and indirectly as an Engagement Manger. In one recent project, one of my Higher Ed clients wanted to setup attribute-based filtering. The matter got escalated to me and I helped the client in setting this up. I documented the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advgb_blocks_editor_width":"","advgb_blocks_columns_visual_guide":"","site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[12],"tags":[13,14,15,16,17,18],"class_list":["post-1064","post","type-post","status-publish","format-standard","hentry","category-m365","tag-aadconnect","tag-attribute","tag-attribute-based-filtering","tag-filtering","tag-metaverse","tag-synchronization"],"featured_image_src":null,"author_info":{"display_name":"Suresh","author_link":"https:\/\/www.pingalasolutions.com\/?author=1"},"author_meta":{"display_name":"Suresh","author_link":"https:\/\/www.pingalasolutions.com\/?author=1"},"featured_img":null,"coauthors":[],"tax_additional":{"categories":{"linked":["M365<\/a>"],"unlinked":["M365<\/span>"]},"tags":{"linked":["AADConnect<\/a>","Attribute<\/a>","Attribute-based filtering<\/a>","Filtering<\/a>","Metaverse<\/a>","Synchronization<\/a>"],"unlinked":["AADConnect<\/span>","Attribute<\/span>","Attribute-based filtering<\/span>","Filtering<\/span>","Metaverse<\/span>","Synchronization<\/span>"]}},"comment_count":"0","relative_dates":{"created":"Posted 6 years ago","modified":"Updated 3 years ago"},"absolute_dates":{"created":"Posted on December 16, 2019","modified":"Updated on January 17, 2023"},"absolute_dates_time":{"created":"Posted on December 16, 2019 10:48 pm","modified":"Updated on January 17, 2023 8:35 pm"},"featured_img_caption":"","series_order":"","_links":{"self":[{"href":"https:\/\/www.pingalasolutions.com\/index.php?rest_route=\/wp\/v2\/posts\/1064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pingalasolutions.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pingalasolutions.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pingalasolutions.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pingalasolutions.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1064"}],"version-history":[{"count":6,"href":"https:\/\/www.pingalasolutions.com\/index.php?rest_route=\/wp\/v2\/posts\/1064\/revisions"}],"predecessor-version":[{"id":1436,"href":"https:\/\/www.pingalasolutions.com\/index.php?rest_route=\/wp\/v2\/posts\/1064\/revisions\/1436"}],"wp:attachment":[{"href":"https:\/\/www.pingalasolutions.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pingalasolutions.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pingalasolutions.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}