AADSync - Configure filtering Part 1
I have had several cases with questions on AADSync Filtering. As a general rule I never use Outbound filtering as these are not saved during upgrade. In this posting we will discuss one of the options used to filter objects as it is described in the msdn article : https://msdn.microsoft.com/en-us/library/azure/dn801051.aspx by using the cloudFiltered(negative filtering option).
Once you read this article you should take away the following
-
- Filter users & groups based on attributes using negative filtering
- Understand how to test your rules without actually syncing objects to the cloud
- Utilize the object preview tool within AADSync console to confirm your rules are correctly configured
Scenario:
In my discussion with the business we want to control who and what makes it to the cloud. In this we only want to create users that have the office items PPG Value this attribute in AD is ‘physicalDeliveryOfficeName’ . The additional requirement is they do not want any groups created in the cloud.
First lets set the stage:
(Picture 1)
Next we installed AAD with all the default sync rules – without running the initial sync steps
- As a note I have also configured the MA to scope to 1 OU to reduce time on sync during demo https://msdn.microsoft.com/en-us/library/azure/dn801051.aspx
Lets begin!
1. Open Sync Rule Editor – This step we will configure the users we want to sync
(Picture 2)
2. Click New Sync rule
(Picture 3)
- Give the rule a descriptive name, such as In from AD – User DoNotSyncFilter, select the correct forest, User as the CS object type, and Person as the MV object type. In Link Type select Join and in precedence type a value currently not used by another Synchronization Rule, e.g. 50. Click Next.
(Picture 4)
- In Scoping filter click Add Group, click Add Clause and in attribute select physicalDeliveryOfficeName. Make sure the Operator is set to NOTEQUAL and type in the value PPG in the Value box. Click Next.
(Picture 5)
- Leave the Join rules empty and click Next.
(Picture 6)
- Click Add Transformation, select the FlowType to Constant, select the Target Attribute cloudFiltered and in the Source text box, type in True. Click Add to save the rule.
(Picture 7)
To test this we do not just simple run of automated sync as we want to confirm everything is sound. So for this we look at the way Identity management works. So first being a state based system we want to import the objects to the CS(Connector Space) . AD –> CS --> (SYNC RULE) --> MV
7. First lets run a full import
8. Now that the full import is complete we see out objects
9. Click on the 8 Objects
(Picture 8)
10. Now we see all objects staged in the connector
(Picture 9)
11. Next in this step we will simulate what a full sync would do for this object , expected result based on our rule is we create the user in the cloud , Select our PPG user and Select Properties
(Picture 10)
12. Next we see the staged object we will then click Preview
(Picture 11)
13. Next Click Generate Preview
14. Once this generate completes you will see several items and I will go into what we are looking at
1. Is what we see in the CS and what sync rules are being apply to the attribute or contributing . Like in the above we see ‘In from AD – User Common’ is contributing to ‘sAMAccountName’. You will also notice that you do not see our sync rule or attribute being applied and this is confirmed by Item 4 as you will see it not listed.
2. This is the generated connector object staged to be created
3. This is our original AD connected object. This would tell you if you had any updates being written back to this object if in a hybrid scenario
15. Let’s now do the same steps for the non PPG user as steps 11-13 above
16. Now we see a completely different story as we look at the other user type.
1. Now we see that our scoping filter we defined back in Picture 4 has been applied as the Item 3 says this sync rule is connected .
2. We also notice this object has not created a pending connector for the cloud connector
17. During steps 10-13 was a simulation on what we expect the Full/Delta sync to do when we decide to run
18. Now we want to do the same for group but exclude groups all together as this was the business rule not to sync any groups in the cloud
19. We will now do same steps in creating the Group sync rule with slight adjustments based on the scenario we do not want to create any groups in the cloud
-
- Make sure Inbound is selected and click Add New Rule.
- Give the rule a descriptive name, such as In from AD – Group DoNotSyncFilter, select the correct forest, Group as the CS object type, and Group as the MV object type. In Link Type select Join and in precedence type a value currently not used by another Synchronization Rule, e.g. 51. Click Next.
- Leave Scoping filter empty and Click Next. – This means this rule will apply to all Groups
- Leave the Join rules empty and click Next.
- Click Add Transformation, select the FlowType to Constant, select the Target Attribute cloudFiltered and in the Source text box, type in True. Click Add to save the rule.
Now if we run through the simulation with groups like we did with users we can see that the group is filtered from being created in the cloud
At the end of the day it only takes 2 sync rules to create users only with PPG in the Office attribute and then exclude all groups from being created in the cloud. This is one of 2 option with using attribute based filtering. I will never recommend Outbound filtering as these setting are not kept during upgrade as it says in the article mentioned above.
