Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Entra IDEasy
An organization is setting up Microsoft Entra Connect to synchronize identities from its on-premises Active Directory to Microsoft Entra ID. The organization has several organizational units (OUs) that contain service accounts and disabled user accounts that should NOT be synchronized to Microsoft Entra ID. How can you prevent these specific OUs from synchronizing?
- AModify the synchronization rules to exclude the OUs.
- BUse the Microsoft Entra Connect wizard to configure OU filtering.
- CDisable the synchronization service for those OUs in Active Directory.
- DConfigure attribute-based filtering in Microsoft Entra Connect.
Show answer & explanationAnswer & explanation
Correct answer: B. Use the Microsoft Entra Connect wizard to configure OU filtering.
During the initial setup or subsequent configuration of Microsoft Entra Connect, the wizard provides an option to select specific organizational units (OUs) for synchronization. By deselecting the OUs containing service accounts and disabled user accounts, you can prevent them from being synchronized to Microsoft Entra ID.
Why the other options are wrong
- A. Modifying sync rules is possible but more complex than using the wizard for OU filtering.
- C. There is no built-in mechanism in Active Directory to disable synchronization services per OU.
- D. Attribute-based filtering is more granular for specific attributes, not entire OUs.
Microsoft Entra Connect OU Filtering
OU filtering in Microsoft Entra Connect allows administrators to select specific Organizational Units (OUs) from their on-premises Active Directory to be synchronized to Microsoft Entra ID.
- Prevents unwanted objects from synchronizing to the cloud.
- Configured during initial setup or through the Microsoft Entra Connect wizard.
- Reduces the number of objects managed in Microsoft Entra ID.
Memory trick: Filter by OU, Attribute, or Domain to control what goes to the cloud.