Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Entra IDEasy
An organization is setting up Microsoft Entra Connect to synchronize identities from its on-premises Active Directory to Microsoft Entra ID. They have several Organizational Units (OUs) that contain service accounts and disabled user accounts which should NOT be synchronized to Microsoft Entra ID to reduce clutter and improve security. Which feature of Microsoft Entra Connect should be configured to exclude these specific OUs?
- ADomain filtering
- BAttribute filtering
- CGroup-based filtering
- DOrganizational Unit (OU) filtering
Show answer & explanationAnswer & explanation
Correct answer: D. Organizational Unit (OU) filtering
Organizational Unit (OU) filtering in Microsoft Entra Connect allows administrators to specify which OUs from the on-premises Active Directory should be synchronized to Microsoft Entra ID, effectively excluding unwanted OUs.
Why the other options are wrong
- A. Domain filtering excludes entire Active Directory domains, which is too broad for specific OUs within a domain.
- B. Attribute filtering excludes objects based on specific attribute values, not their OU location.
- C. Group-based filtering synchronizes only members of specific groups, which can be more complex to manage for broad exclusions than OU filtering.
Microsoft Entra Connect OU Filtering
Microsoft Entra Connect Organizational Unit (OU) filtering allows administrators to select specific OUs within their on-premises Active Directory that should be synchronized to Microsoft Entra ID. This is used to control which objects are provisioned to the cloud.
- Prevents unwanted objects from syncing.
- Configured during or after Microsoft Entra Connect installation.
- Reduces cloud clutter and improves security.
Memory trick: Filter: Only the Best Bits Go Up