Office 365 Dynamic Distribution Groups Filtered by On-Premise Organization Unit (OU).

I have been asked a number of times if it is possible to create Dynamic Distribution Groups in Office 365 filtered by the On-Premise Organization Unit (OU). I recently discovered a method to achieve this with some collaboration with a couple of colleagues.

Essentially we need to create an inbound synchronization rule in AADConnect to send the Distinguished Name from On-Premise Active Directory up to Office 365 as custom attributes.

First and foremost, update your AADConnect version! See

August 2018 update

Steps to create the rule

From the AADConnect server click start, and type sync you should see the 'Synchronization Rules Editor'. We will use this tool to create the rules.

Click add new rule, complete the first page as below. Pay close attention to these settings, Link Type for example defaults to Provision which is incorrect this in scenario.


Scoping filters left blank.

Join rules also left blank.

The real work happens under Transformations.

In the first expression I am synchronising the full Distinguished Name from On-Premise AD to extensionAttribute10. This is customAttribute10 in Exchange Online.


In the second expression I am synchronising the 2nd component in the Distinguished Name from On-Premise to extensionAttribute11. This is customAttribute11 in Exchange Online.


Need something else maybe? Use

There is no need to do both, I am just showing the possibilities. Perhaps you only need the the second expression example to create your DDG.

My observations after making these changes

After changes to the rules, the new values are not seen in the custom attributes until:

  1. A value on the individual object is updated and a delta sync runs or
  2. An initial sync is run.

So make sure to run a full sync after creating a rule. Start-ADSyncSyncCycle -PolicyType initial

Once an initial sync is run after the rule creation, delta syncs send updates to the OU path just fine.

Results on a sample Exchange Online object:

I am now ready to setup a Dynamic Distribution group based off of CustomAttribute11 with a value of 'nintendo'. I put the full OU in CustomAttribute10 in case there is a use case out there where this is needed.

I tested all this by creating a Dynamic Distribution Group with an additional rule of customAttribute11 as 'nintendo', note my deliberate omission of the capitalisation just for the sake of testing if this is important, it is not. Sent an email to the SMTP address of the DDG and confirmed mail delivery to the individuals in the DDG. Perfect!

August 2018 Update

Since first writing this blog article a little over a year ago I have completely rebuilt my lab environment and did not set this configuration back up. I now have a lab with over 75,000 sync'ed objects so have good basis to test this again.

I ran through the steps as originally documented with no issues. As I previously noted only objects which have attributes updated post changes will have the On-Premise OU attributes updated / sync'ed to the cloud on the next delta sync. I tested this out by updating several address type fields on a single account and running a delta sync. Only the object I updated out of ~77,000 objects updated in the delta sync. From this test I can confirm the necessity to run an initial sync so all sync'ed objects get the On-Premise OU sync'ed to custom attributes in the cloud. You then have a consistent data set in the cloud to create Dynamic Distribution Groups from.

Running an initial sync after these changes on slightly over 75,000 objects took just under 4 hours to complete in my lab environment.

Comments (7)

  1. sos says:

    como hago el filtro si tengo varias OU con el mismo nombre

    How do I filter if I have several OU with the same name?

    1. JeKnight says:

      En este caso usted debe utilizar el ejemplo de CustomAttribute10 en este post del blog. Cuando quieras añadir las normas del grupo de distribución dinámico una cadena que es única para cada unidad de organización. En mi ejemplo “OU=Nintendo,OU-Synchronised,OU=Office 365” es único ya que se trata de una buena parte del árbol de la unidad de organización de los objetos.

      For this scenario you should use the CustomAttribute10 example in this blog post. When you come to add the Dynamic Distribution Group rules add a string which is unique for each organisation unit. In my example “OU=Nintendo,OU-Synchronised,OU=Office 365” is unique since this is a good chunk of the Organisation Unit tree of those objects.

  2. studerje says:

    When I try to set the transforms up and click the final ‘add’ I get an error stating, “Object reference not set to an instance of an object”. any suggestions?

    1. JeKnight says:

      When running through this and documenting the process I have run into a couple of warnings which stopped me at the same point you are at. Two things come to mind to check:
      1. Update AADConnect to the latest version in case this is an issue for you.
      2. Pay close attention to the settings on the first screen. The settings in the drop down menus tripped me up as I was testing and not completely validating everything. Link Type for example defaults to Provision, where we actually need Join instead.

      1. studerje says:

        Sorry, I should have clarified that I followed the steps as outlined. I updated AADConnect to the latest version and verified the steps.
        I just tried it again and triple checked all settings and still get the “Object reference not set to an instance of an object” message. we are running in a hybrid environment, could that be the issue?

  3. Peter Lane says:

    For connected system, it appears you are selecting your local AD domain ( — not your O365 tenant domain. Is this correct?

    1. JeKnight says:

      Hi Peter,

      Yes that is correct.



Skip to main content