0

Anyone having some more filtering experience with synchronization rule functionality

We have Azure AD connect and want to specifically filter users based on attributes info. We should only sync individual which have an defined mail alias string and that mail alias string compares with the UPN.

User information when not sync to Office 365 should occur, default:

userPrincipalName is:        firstname + sur + @domain.local
samAccountName is:    DOMAIN\firstname + sur
mail is:                     firstname + surname + @domain.top

Today we have these settings(including the standards):

userPrincipalName ENDSWITH @domain.top
mail              ENDSWITH @domain.top

So we do check today that the users have an value in the mail attribute field and that it ends with the correct domain. Mail alias is created when the user has an mailbox created.

And we also check that the UPN ends with the same domain as the mail alias - this is manually changed when a user should be synced.

What can happens here is that the admin changes the UPN @domain.top but forgets the firstname + sur should be firstname + surname

We want to ensure that the two attributes, UPN and mail, are identical in a ordinary string comparison before the sync are allowed to occur.

e.g

userPrincipalName IDENTICAL %@domain.top
mail              IDENTICAL %@domain.top

meaning the value of userPrincipalName and mail must be exactly IDENTICAL regardless of the string value before @domain.top

1 Answer 1

0

We can modify Azure AD connect synchronization rules to do this. Here is my filter: enter image description here

I had create two user in my on-premises AD, jason10001 and jason10002, jason10001's mail is [email protected], and jason10002's mail not set. enter image description here enter image description here
Then run the synchronization service, We can find the user sync to AAD: Only jason10001 sync to AAD, jason10002 not sync to AAD. I think you can use this way to sync users to AAD. enter image description here

More information about AAD connect filter, refer to the link.

2
  • Just checking in to see if the information provided was helpful. Please let me know if you would like further assistance.
    – Jason Ye
    Feb 22, 2017 at 5:31
  • thanks for the reply, but unfortunately as stated in my initial question we already have that comparison you describe and it's not enough (as it will sync for UPN: test(at)domain.top and mail: tests(at)domain.top as it both contains/endswith a value "true"). We want to ensure that the whole string is identical where the string value before the @domain.top is dynamically based on the users first and surname.
    – gojj
    May 4, 2017 at 19:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .