AADSync – Configure filtering Part 1

I have had several cases with questions on AADSync Filtering. As a general rule I never use Outbound filtering as these are not saved during upgrade. In this posting we will discuss one of the options used to filter objects as it is described in the msdn article : http://msdn.microsoft.com/en-us/library/azure/dn801051.aspx  by using the cloudFiltered(negative filtering option).

Once you read this article you should take away the following

    • Filter users & groups based on attributes using negative filtering
    • Understand how to test your rules without actually syncing objects to the cloud
    • Utilize the object preview tool within AADSync console  to confirm your rules are correctly configured

In my discussion with the business we want to control who and what makes it to the cloud. In this we only want to create users that have the office items PPG Value this attribute in AD is  ‘physicalDeliveryOfficeName’ . The additional requirement is they do not want any groups created in the cloud.

First lets set the stage:  

(Picture 1) 

Next we installed AAD with all the default sync rules – without running the initial sync steps
– As a note I have also configured the MA to scope to 1 OU to reduce time on sync during demo http://msdn.microsoft.com/en-us/library/azure/dn801051.aspx

Lets begin!

1. Open Sync Rule Editor – This step we will configure the users we want to sync

(Picture 2) 

2. Click New Sync rule 

(Picture 3) 

  1. Give the rule a descriptive name, such as In from AD – User DoNotSyncFilter, select the correct forest, User as the CS object type, and Person as the MV object type. In Link Type select Join and in precedence type a value currently not used by another Synchronization Rule, e.g. 50. Click Next.

(Picture 4) 

  1. In Scoping filter click Add Group, click Add Clause and in attribute select physicalDeliveryOfficeName. Make sure the Operator is set to NOTEQUAL and type in the value PPG in the Value box. Click Next.

clip_image007(Picture 5) 


  1. Leave the Join rules empty and click Next.

(Picture 6) 


  1. Click Add Transformation, select the FlowType to Constant, select the Target Attribute cloudFiltered and in the Source text box, type in True. Click Add to save the rule.

(Picture 7) 

To test this we do not just simple run of automated sync as we want to confirm everything is sound. So for this we look at the way Identity management works. So first being a state based system we want to import the objects to the CS(Connector Space) . AD –> CS –>(SYNC RULE) –> MV

7. First lets run a full import


8. Now that the full import is complete we see out objects


9. Click on the 8 Objects

(Picture 8) 

10.  Now we see all objects staged in the connector

(Picture 9) 

11.  Next in this step we will simulate what a full sync would do for this object , expected result based on our rule is we create the user in the cloud , Select our PPG user and Select Properties

(Picture 10) 

12.  Next we see the staged object  we will then click Preview

(Picture 11) 

13.  Next Click Generate Preview


14.  Once this generate completes you will see several items and I will go into what we are looking at


1. Is what we see in the CS and what sync rules are being apply to the attribute or contributing . Like in the above we see ‘In from AD – User Common’ is contributing to  ‘sAMAccountName’. You will also notice that you do not see our sync rule or attribute being applied and this is confirmed by Item 4 as you will see it not listed.

2. This is the generated  connector object staged to be created


3. This is our original AD connected object. This would tell you if you had any updates being written back to this object if in a hybrid scenario

15.  Let’s now do the same steps for the non PPG user as steps 11-13 above

16.  Now we see a completely different story as we look at the other user type. 


1. Now we see that our scoping filter we defined back in Picture 4 has been applied as the Item 3 says this sync rule is connected .

2. We also notice this object has not created a pending connector for the cloud connector

17.  During steps 10-13 was a simulation on what we expect the Full/Delta sync to do when we decide to run

18. Now we want to do the same for group but exclude groups all together as this was the business rule not to sync any groups in the cloud

19. We will now do same steps in creating the Group sync rule with slight adjustments based on the scenario we do not want to create any groups in the cloud

    1. Make sure Inbound is selected and click Add New Rule.
    2. Give the rule a descriptive name, such as In from AD – Group DoNotSyncFilter, select the correct forest, Group as the CS object type, and Group as the MV object type. In Link Type select Join and in precedence type a value currently not used by another Synchronization Rule, e.g. 51. Click Next.
    3. Leave Scoping filter empty and Click Next.  – This means this rule will apply to all Groups
    4. Leave the Join rules empty and click Next.
    5. Click Add Transformation, select the FlowType to Constant, select the Target Attribute cloudFiltered and in the Source text box, type in True. Click Add to save the rule.
  1. Now if we run through the simulation with groups like we did with users we can see that the group is filtered from being created in the cloud


At the end of the day it only takes 2 sync rules to create users only with PPG in the Office attribute and then exclude all groups from being created in the cloud. This is one of 2 option with using attribute based filtering. I will never recommend Outbound filtering as these setting are not kept during upgrade as it says in the article mentioned above.


Comments (10)

  1. Francesco says:

    Great article! 🙂 cool!

  2. Anonymous says:

    Continuing from our previous post AADSync – Configure filtering Part 1 we will now look at using expressions

  3. ML49448 says:

    Hi, don’t you need to disable the Scheduling task to prevent AADSync from unattended run, while experimenting with filtering?

  4. Topher says:

    Michael, yes. Probably a good idea to disable the scheduled task for automatic sync until you have all of your rules tweaked and working as expected. During the installation of AADSync, if you uncheck the box to perform "Full Synchronization Now" at the
    end of the wizard, it will create the task but disable it for you after creation.

  5. Tanel says:

    Very useful information. It just helped us to hide on-premise AD users from O365 GAL without expanding the schema. Many thanks!

  6. Hi David. This is a great article!
    I hope you could drop me some light with a question. Here’s the situation.

    Our connector is looking at some specific OUs in our AD. Whenever a user left the company, we’re moving the object to another OU. At Office 365 portal I can still see those user accounts being synced although I can’t delete them by using the portal (as the
    option is not clickeable).

    Is there a way to create a OU filter in order to remove the user accounts I don’t need in the portal anymore?

    Thanks in advance!

  7. anonymouscommenter says:

    In support we see many cases come through looking to create a customized synchronization rule to adhere

  8. Steen says:

    Made a simpe inbound filter that looks at customattribute3 and if it contains "sync" the group/user/device/person is synced to Azure. This works fine. But for some reason it sometimes does not remove the account once customattribute3 is "blank" sometimes
    it just removes the information on the synced metaverse account and leaves it out there?

  9. anonymouscommenter says:

    Hello again! Tim Macaulay here from the Identity Support team here at Microsoft. Recently I worked through

Skip to main content