Question

Your organization uses Microsoft Entra Connect Sync in a hybrid environment. The security team requires that user accounts located in a specific on-premises Active Directory organizational unit (OU) named 'ServiceAccounts' must NOT be synchronized to Microsoft Entra ID, while all other OUs continue to sync normally. What is the correct way to accomplish this?

Accepted Answer

Configure organizational unit–based filtering in the Microsoft Entra Connect Sync configuration wizard and clear the 'ServiceAccounts' OU.

Answer

Delete the 'ServiceAccounts' users from Microsoft Entra ID and place them on the block list in the Microsoft 365 admin center.

Answer

Create a Conditional Access policy that blocks the 'ServiceAccounts' users from signing in to cloud services.

Answer

Set the msExchHideFromAddressLists attribute on each account in the 'ServiceAccounts' OU.