Microsoft Certified: Azure Administrator AssociateImplement and manage hybrid identitiesMedium
A company is implementing Azure AD Connect and wants to ensure that all user objects synchronized from their on-premises Active Directory to Azure AD have a unique and immutable identifier. Which attribute is automatically used by Azure AD Connect for this purpose, assuming default configuration?
- Amail
- BobjectGUID
- CsAMAccountName
- DuserPrincipalName
Show answer & explanationAnswer & explanation
Correct answer: B. objectGUID
By default, Azure AD Connect uses the on-premises Active Directory 'objectGUID' attribute as the source anchor (immutable ID) for user objects synchronized to Azure AD. This ensures a globally unique and unchanging identifier for each object.
Why the other options are wrong
- A. mail is an email address, which can change and is not guaranteed to be unique.
- C. sAMAccountName is unique within a domain but not globally unique and can change.
- D. userPrincipalName is used for sign-in but can change and is not immutable.
Azure AD Connect Source Anchor
A unique, immutable attribute chosen from on-premises Active Directory that Azure AD Connect uses to identify a synchronized object over its lifetime in Azure AD.
- Crucial for maintaining object identity during synchronization and across forests.
- Default attribute for users is 'objectGUID'.
- Once set, it should not be changed without careful planning.
Memory trick: The 'anchor' must be 'unique' and 'never change'.