Field Notes: Azure AD Connect – Attribute-based Filtering

This is a continuation of a series on Azure AD Connect. I recently covered using domain/OU and group filtering options that are available in Azure AD Connect to help control which objects are synchronized to Azure AD. I also took a closer look in group filtering, which is not recommended for use in production. Another filtering mechanism I would like to cover before moving on to another topic is attribute-based filtering. This is, however, not something we achieve through the Azure AD Connect wizard that we have been using throughout the series, but the Synchronization Rules Editor. A full list of related blog posts is provided in the summary section below.

Attribute-based filtering

We now know that filtering using a security group is not recommended as pointed out in the previous blog post. What other options do we have — if we, say — wanted to filter out (exclude) some of the user objects residing in an OU selected for synchronization? Attribute-based filtering! The Azure AD Connect sync: Configure filtering document has finer details on attribute-based filtering. I’ll just go through an example to see how this feature could be leveraged to filter objects based on attribute values.

Environment setup

To simplify demonstration of this feature, I focus on only one of the domains I have in my test AD forest – idrockstar.co.za. The VIP OU in that domain is already selected for synchronization as shown below.

I created two user accounts in the VIP OU:

First VIP – should be synchronized to Azure AD
Second VIP – should NOT be synchronized to Azure AD (cloud filtered)

I further updated Second VIP‘s extentionAttribute15 attribute have a value of NoSync. The idea is to apply negative filtering based on this attribute, but more on this is covered in the next section.

Applying attribute-based filtering

The tool for this job is the Synchronization Rules Editor. This tool can be used to view, edit and/or create new synchronization rules that control attribute flows.

Once the tool is open, new rules can be added by clicking the add new rule button. Note that the direction (inbound) was already selected by default. I highlight this as there is also an option for outbound filtering, which I don’t cover in this post. I click the (add new rule) button to start the wizard.

Clicking the add new rule button opens up a create new inbound synchronization rule wizard that is needed to apply the negative filter (do not synchronize objects that meet the critiria). I provide the following information on the description page and click next to proceed:

Name: this should describe the purpose of the rule (visible in the default view of Synchronization Rules Editor)
Description: more details on what the rule aims to achieve (optionally used to provide more information)
Connected System: this is the on-premise directory – idrockstar.co.za in my case
Connected System Object Type: target object type is user in this example
Metaverse Object Type: user objects are presented as person type in the metaverse
Link Type: join is selected by default – I leave this unchanged
Precedence: defines which rule wins in case of a conflict when more than one group contribute to the same attribute. The rule with the lower precedence number (higher priority) wins.

The rest of the fields are not necessary for this exercise.

On the scoping filter page, I click add group, followed by the add clause button and specify the value of NoSync for extentionAttribute15.

I click next, and next again to skip the join rules as they are not required for our task. On the transformations page, I click the add transformation button and complete the form as follows:

FlowType – Constant
Target Attribute – cloudFiltered
Source – True

I leave everything else default.

To finish off, I click add at the bottom of the page (not shown in the screenshot). A warning message stating that a full (initial) synchronization will be run on the directory during the next synchronization cycle is displayed. Be prepared for this when you apply this feature in your environment. I click OK to dismiss the dialog box.

Looking back at the main Synchronization Rules Editor window, we can confirm that the new rule was added.

The effect of attribute-based filter

Looking at the Troubleshooter that we covered here, we see that:

the Second VIP user object is found in the AD Connector Space
the Second VIP user object is found in the Metaverse, but
the Second VIP user object is not found in the Azure AD Connector space

The Connector Space Object Properties windows in the Azure AD Connect Synchronization Service shows that Second VIP has been deleted (it had initially been exported).

The Metaverse Object Properties window confirms that the cloudFiltered attribute was indeed set to the value of true by the rule we created. (The connectors tab would also reveal that the object is only present in the on-prem AD connector and not in the Azure AD connector.)

Finally, looking at Azure AD confirms that Second VIP was filtered out and is not available in the Azure AD user list. Only First VIP is showing.

Summary

This was a third blog post on filtering, which covered attribute-based filtering in Azure AD Connect. This feature provides a way to filter objects based on attribute values. Below is a list of references that provide a lot more detail if required. I have also provided a list to all previous Azure AD Connect-related blog posts below.

References

Till next time…

Beystor Makoala