Restricting Directory synchronization to Organization Unit

The default configuration of Azure Active directory connector will take all objects in all domains in the forest to synchronize with Azure Active Directory tenant. In fact, this recommended configuration will facilitate access to the complete Global Address List. With this, the end user using cloud services such as Exchange Online and Skype will have same experience of an on-premises implementation.

In some cases, you may have the requirement of synchronizing only a specific set of users. For instance, the management decision to restrict the cloud service to only users from sales department. In this case you need select users from Sales OU only (assuming the users are in their respective department OUs). In other scenario where you do not want to synchronize the service accounts which are used for only on-premises service.

With filtering you can control which objects should appear in Azure Active Directory from your on-premises directory. Selecting only the required objects for synchronization will provide more security by reducing the surface area attacks. Filtering can also help to limit the number of objects, which can keep the Azure Active Directory Sync database small enough to use the default SQL Express Local Database.

Following are the filtering options which can be applied to the Azure Directory Synchronization tool:

  • Domain based: This option allows selection of the domains to synchronize to Azure AD, this will include all object types in the selected Domain(s).
  • Organizational Unit based: This option allows selection of the OUs which will synchronize to Azure AD, this will include all object types in the selected in selected OU(s).
  • Attribute based: This option allows to filter objects based on attribute values on the objects.

You can use a combination of the above filtering options available. When multiple filtering options are used, the tool will use a logical “and” condition among the filters.

In this post, we will be describing the steps used in configuring the OU based filtering.

First of all, we will disable the “Azure AD Sync Scheduler” from the local task scheduler. This will eliminate the risk of accidentally synchronizing the objects which we have not yet verified.

Start Task Scheduler from the start menu.

Directly under Task Scheduler Library find the task named Azure AD Sync Scheduler, right-click and select Disable.



Configuring Organizational Unit based filtering

To configure organizational-unit–based filtering, perform the following steps:

Logon to the server that is running Azure AD Connect sync tool using an account that is a member of the ADSyncAdmins security group.

Start Synchronization Service from the start menu.


Select Connectors and in the Connectors list, select the Connector with the type Active Directory Domain Services. From Actions select Properties.

Click Configure Directory Partitions, select the domain you want to configure, and then click Containers.


When prompted, provide any credentials with read access to your on-premises Active Directory. It does not have to be the user which is pre-populated in the dialog box.


In the Select Containers dialog box, clear the OUs that you don’t want to synchronize with the cloud directory, When you are done, close the Properties dialog by clicking OK.


Now the filter is applied, do not forget to enable the “Azure AD Sync Scheduler” from the local task scheduler.


Notice that only the objects under the selected Organization Unit gets synchronized to the Azure tenant.


Directory Synchronization using Azure AD Connect

In this post we will configure Directory integration between Azure Active Directory and Windows Server Active Directory using the Azure AD Connect Tool.

Integrating your on-premises directory services with Azure AD will allow users to take advantage of a common identity when accessing both your on-premises and your cloud environments. In other words, the Azure AD give you similar sign-on experience.

Synchronizing both the on-premises and cloud directories have the following benefits:

  • The default option sync with the password hash which allows sign on to cloud resources based on Active Directory passwords.
  • Users will be able to access Office 365, Intune, SaaS apps and third-party applications without having to remember and manage a separate set of credentials.
  • The application developers can build solutions leveraging a common identity model, integrating into on-premises or Azure directory services for cloud-based applications

Let us look at some of the prerequisites:

  • A dedicated member server(recommended) running Windows Server 2008 or later or a Domain Controller
  • Internet access on the server installing Azure AD Connect
  • Azure AD administrator account for the Azure tenant you wish to integrate with on-premises
  • An enterprise administrator account for the on-premises active directory services which will be integrated to the Azure AD tenant.

Hardware requirements for Azure AD Connect

The table below shows the minimum requirements for the Azure AD Connect sync computer.

Number of objects in Active Directory CPU Memory HDD
Fewer than 10,000 1.6 GHz 4 GB 70 GB
10,000–50,000 1.6 GHz 4 GB 70 GB
50,000–100,000 1.6 GHz 16 GB 100 GB
For 100,000 or more objects the full version of SQL Server is required
100,000–300,000 1.6 GHz 32 GB 300 GB
300,000–600,000 1.6 GHz 32 GB 450 GB
More than 600,000 1.6 GHz 32 GB 500 GB

Installing and configuring Azure AD Connect.

To get started using Azure AD Connect, download the latest version from the following link: to the server dedicated for Azure AD connector installation.


Double click on the downloaded installer (AzureADConnect.msi) to start installation.


On the Welcome page, click on agree to the license terms and privacy policy to continue.


Select the Use express settings. This is appropriate if you have a single forest and wish to configure the password synchronization.


In the next step, enter the Global Administrator credentials for the Azure tenant to connect the AD connector tool to the Azure Active directory.

The Global Administrator credentials are used to create a service account that will take care of the synchronization.

click Next to continue.


In the next page enter the On-premises Enterprise administrator credentials for the tool to connect to the on premises Active Directory service. The enterprise administrator credential is used only to create service account and grant proper permissions.

click Next to continue.


In the “Ready to configure” page, verify that the settings are the ones you intended before you click the checkbox to start the synchronization process after the configuration is complete.


As part of the configuration, the tool will install a local instance of SQL Express to support the sync process and the Sync service.


When the installation complete, you will get a confirmation page.


Wait for few minutes for the synchronization to take place, then logon your Azure portal and verify that all your accounts have been synchronized.

Notice that the directory integration tab under your tenant is showing ACTIVATED.


Select USERS under the tenant to verify that the user accounts in the on-premises active directory are displayed.




%d bloggers like this: