What Is Kubernates?

In Azure AD Connect, after installation, admins can exclude certain objects (users, OUs,

attributes, groups, etc.) from synchronization. This is typically done during or after

setup to control which parts of your on-premises Active Directory are synced to Azure 

AD.

✅ 1. Unchecking Organizational Units (OUs)

During setup or in Azure AD Connect > Synchronization Rules Editor / Configuration Wizard, users can select specific OUs to sync.

👉 If they uncheck an OU, it means:

• Objects inside that OU (users, groups, etc.) will not be synced to Azure AD.

• Useful for:

  • Excluding service accounts, test users, or sensitive data.

  • Managing sync scope for performance or security reasons.

📌 Where to find it:
Azure AD Connect > Customize synchronization options > Domain and OU filtering

---

✅ 2. Attribute Filtering (Advanced)

Admins can also exclude attributes from syncing using custom sync rules.

For example:

• You may want to prevent syncing attributes like employeeID or extensionAttributeX.

• This requires editing synchronization rules in the Synchronization Rules Editor.

---

✅ 3. Group Filtering (less common)

With group-based filtering, only objects member of a specific AD group is synced.

• Rarely used, but possible via PowerShell or advanced configuration.

---

🔧 What Happens After Exclusion?

• The next sync cycle will remove those excluded users from Azure AD (if they were previously synced).

• You can trigger a delta sync to apply changes faster:

         Start-ADSyncSyncCycle -PolicyType Delta

🧠 Why This Matters for Infrastructure Engineers:

Being able to scope and control sync protects:

• Tenant hygiene (avoid clutter)

• Security (keep internal-only objects private)

• Licensing (avoid auto-assigning licenses to unnecessary accounts)