We are looking to use ADsync/Dirsync to sync our clients Office 365 to their Active Directory servers. The issue is they have two separate Active Directory domains, DomainA.local and DomainB.local for arguments sake.

How can I sync both AD Domains to a single Office 365 tenant and can I selectively exclude users since some users are in both AD Domains? Currently there is only a Trust relationship between the two AD Domains.


Azure AD Connect (https://www.microsoft.com/en-us/download/details.aspx?id=47594) will allow you to configure both domains for sync up to your single tenant's Azure AD.

You will need to set up their external domain (not the .local) as alternative UPN Suffixes in AD Domains and Trusts. Info here: https://docs.microsoft.com/en-us/office365/enterprise/prepare-a-non-routable-domain-for-directory-synchronization

You can set up a filter to not sync certain objects. Look at the following article under the Negative filtering: "do not sync these" to understand how to do that. https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering


You can sync multiple AD Forests to a single Azure AD/Office 365 tenant. You'll need to use the custom installation option with Azure AD Connect.

A Forest Trust isn't required. You just need to have DNS name resolution between the Forests, which you can achieve with Conditional Forwarders.

The easiest way to filter user and group objects is to set the adminDescription attribute to

User_NoAzureADSync to filter users

Group_NoAzureADSync to filter groups

You can use the Azure AD Connect Rules Editor for more advanced filtering, but TBH, you probably don't need that.

Note that any object where the isCriticalSystemObject attribute is set to TRUE won't sync to Azure AD/Office 365.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.