Anyone having some more filtering experience with synchronization rule functionality
We have Azure AD connect and want to specifically filter users based on attributes info. We should only sync individual which have an defined mail alias string and that mail alias string compares with the UPN.
User information when not sync to Office 365 should occur, default:
userPrincipalName is: firstname + sur + @domain.local
samAccountName is: DOMAIN\firstname + sur
mail is: firstname + surname + @domain.top
Today we have these settings(including the standards):
userPrincipalName ENDSWITH @domain.top
mail ENDSWITH @domain.top
So we do check today that the users have an value in the mail attribute field and that it ends with the correct domain. Mail alias is created when the user has an mailbox created.
And we also check that the UPN ends with the same domain as the mail alias - this is manually changed when a user should be synced.
What can happens here is that the admin changes the UPN @domain.top but forgets the firstname + sur should be firstname + surname
We want to ensure that the two attributes, UPN and mail, are identical in a ordinary string comparison before the sync are allowed to occur.
e.g
userPrincipalName IDENTICAL %@domain.top
mail IDENTICAL %@domain.top
meaning the value of userPrincipalName and mail must be exactly IDENTICAL regardless of the string value before @domain.top