We are looking to use ADsync/Dirsync to sync our clients Office 365 to their Active Directory servers. The issue is they have two separate Active Directory domains, DomainA.local and DomainB.local for arguments sake.
How can I sync both AD Domains to a single Office 365 tenant and can I selectively exclude users since some users are in both AD Domains? Currently there is only a Trust relationship between the two AD Domains.
Azure AD Connect (https://www.microsoft.com/en-us/download/details.aspx?id=47594) will allow you to configure both domains for sync up to your single tenant's Azure AD.
You will need to set up their external domain (not the .local) as alternative UPN Suffixes in AD Domains and Trusts. Info here: https://docs.microsoft.com/en-us/office365/enterprise/prepare-a-non-routable-domain-for-directory-synchronization
You can set up a filter to not sync certain objects. Look at the following article under the Negative filtering: "do not sync these" to understand how to do that. https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering
You can sync multiple AD Forests to a single Azure AD/Office 365 tenant. You'll need to use the custom installation option with Azure AD Connect.
A Forest Trust isn't required. You just need to have DNS name resolution between the Forests, which you can achieve with Conditional Forwarders.
The easiest way to filter user and group objects is to set the adminDescription attribute to
User_NoAzureADSync to filter users
Group_NoAzureADSync to filter groups
You can use the Azure AD Connect Rules Editor for more advanced filtering, but TBH, you probably don't need that.
Note that any object where the isCriticalSystemObject attribute is set to TRUE won't sync to Azure AD/Office 365.
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-custom
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies
