Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Entra IDMedium
A multinational corporation uses Microsoft Entra ID and has implemented Microsoft Entra Connect to synchronize identities from its on-premises Active Directory. They have a requirement to ensure that all user objects synchronized from a specific on-premises domain, 'europe.contoso.com', are provisioned to Microsoft Entra ID. However, users from another domain, 'asia.contoso.com', should be completely excluded from synchronization. Which filtering method should be configured in Microsoft Entra Connect?
- AAttribute-based filtering
- BGroup-based filtering
- CDomain-based filtering
- DOrganizational Unit (OU) filtering
Show answer & explanationAnswer & explanation
Correct answer: C. Domain-based filtering
Domain-based filtering in Microsoft Entra Connect allows you to select which Active Directory domains participate in synchronization. To include 'europe.contoso.com' and exclude 'asia.contoso.com', you would simply deselect the 'asia.contoso.com' domain during the Microsoft Entra Connect configuration.
Why the other options are wrong
- A. Attribute-based filtering excludes objects based on attribute values, not their domain membership.
- B. Group-based filtering synchronizes only members of specific groups, which is not suitable for excluding an entire domain efficiently.
- D. OU filtering operates within a domain, not across entire domains.
Microsoft Entra Connect Domain Filtering
Microsoft Entra Connect Domain filtering allows administrators to select which on-premises Active Directory domains are included in the synchronization process to Microsoft Entra ID. This is a high-level filtering mechanism to manage identity flow from multi-domain or multi-forest environments.
- Selects entire AD domains for sync.
- Configured during Microsoft Entra Connect installation.
- Useful in multi-domain or multi-forest scenarios.
Memory trick: Scope: Domains Define the Boundary