Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Entra IDMedium
A company is planning to implement Microsoft Entra Connect Cloud Sync to synchronize users from a single on-premises Active Directory Domain Services (AD DS) domain. They have identified several Organizational Units (OUs) within this domain that contain legacy user accounts and service accounts that should *not* be synchronized to Microsoft Entra ID. You need to ensure that only specific OUs are synchronized. How should you configure Cloud Sync to achieve this?
- AModify the synchronization rules in Synchronization Service Manager.
- BDefine the desired OUs directly in the Cloud Sync configuration within the Microsoft Entra admin center.
- CDisable the synchronization for the entire domain via PowerShell.
- DConfigure attribute-based filtering for each user in the OUs.
Show answer & explanationAnswer & explanation
Correct answer: B. Define the desired OUs directly in the Cloud Sync configuration within the Microsoft Entra admin center.
Microsoft Entra Connect Cloud Sync allows you to define the specific Organizational Units (OUs) to be synchronized directly within its configuration in the Microsoft Entra admin center. This is the intended and most efficient way to achieve OU filtering for Cloud Sync.
Why the other options are wrong
- A. Synchronization Service Manager is used for Microsoft Entra Connect (full sync), not for Cloud Sync.
- C. Disabling synchronization for the entire domain is too broad and would prevent all other desired users from synchronizing.
- D. Attribute-based filtering is for individual users based on attributes, not for efficient OU exclusion in Cloud Sync.
Cloud Sync Domain and OU Filtering
In Microsoft Entra Connect Cloud Sync, filtering allows administrators to explicitly define which domains and Organizational Units (OUs) from on-premises Active Directory are synchronized to Microsoft Entra ID.
- Configured directly in the Microsoft Entra admin center.
- Supports both domain-level and OU-level filtering.
- Essential for controlling the scope of synchronized objects.
- More granular than domain filtering alone.
Memory trick: Cloud Sync: Configure OUs directly in the Cloud.