Question

Contoso runs Entra Connect Sync with the default configuration synchronizing all users from an on-premises Active Directory forest. The security team requires that user accounts located in an OU named 'ServiceAccounts' must never be synchronized to Microsoft Entra ID, while all other OUs continue to sync unchanged. You must implement this with the least administrative effort and without affecting objects already synced from other OUs. What should you do?

Accepted Answer

Run the Entra Connect wizard, choose 'Customize synchronization options', and configure domain and OU-based filtering to clear the 'ServiceAccounts' OU.

Answer

Create an inbound synchronization rule that sets the cloudFiltered attribute to True only for objects whose distinguishedName does not contain 'ServiceAccounts'.

Answer

Move all objects in the 'ServiceAccounts' OU to a new forest and configure a separate connector that is left in staging mode.

Answer

Delete the affected accounts from Microsoft Entra ID and add each one to a group configured as an exclusion for group-based licensing.