Chapter 3. Exploring Advanced Synchronization Concepts

In current projects and workshops, we often see that administrators or consultants find handling the Azure AD Connect synchronization engine difficult, especially if the out-of-the-box functionality configured by the wizard doesn't work as expected in their scenarios. The chapter will give you all the needed knowledge so that you can handle basic and advanced synchronization requirements.

In this chapter, we'll discuss advanced synchronization concepts. We'll look into the synchronization rules and work with practical situations to provide you with the information and practical experience you need to solve common requests in your projects or solutions. Furthermore, we explain the declarative provisioning and expressions concept and use them directly in real-world examples. Another topic in this chapter is the connection to an additional untrusted Active Directory forest. Finally, we'll give you an idea of the special considerations you...

Preparing your lab environment

To work through the guidance provided in this chapter, we need to arrange some preparation tasks. You need to provide an additional public DNS suffix (which in my case is azureid.ch) that represents YOURDOMAIN2.COM. We need to add this other domain as a custom domain in the first Azure AD tenant (YOURDOMAIN1.ONMICROSOFT.COM), which we used in Chapter 2, Understanding Identity Synchronization:

Use the following steps to start the configuration:

1. Open the Azure Portal: https://portal.azure.com.
2. Navigate to the Azure AD blade. 
3. Click Custom domains. 
4. Click Add custom domain. 
5. Use your additional domain name:

Adding a custom domain

6. Configure your public DNS to represent the following verification entry:

Custom domain verification

7. Click Verify. 
8. The following result is expected:

Verified domains overview

The following diagram shows the complete lab environment we'll use in this book:

Lab environment overview

Furthermore, we need to configure a new Active Directory Forest that uses...

Understanding declarative provisioning and expressions

The easiest way to explain declarative provisioning is as follows: objects are processed from the source connected directory to the target source by evaluating how the objects and the associated attributes should be transformed. This is controlled by inbound rules from the connector space to the metaverse and outbound rules from the metaverse to the connector space. The following diagram gives you an overview of all of the components:

Declarative provisioning options and components overview

Declarative provisioning provides the following capabilities:

• The only way to configure the sync engine
• Functions to configure attribute flows
• Precedence is on SRs (not on Connectors)
• MV—deletion rules now use declarative provisioning
• Introduces parameters, such as %Domain.Netbios%
• Configured through PowerShell

The attribute-flow expression language can be explained as follows:

• Written in Visual Basic for Applications (VBA)
• Stricter syntax:
  • Useful errors for...

Synchronization rules explained

Azure AD Connect uses an extra user interface in the Synchronization Rules Editor to manage the synchronization logic. In the following screenshot, you can see all of the synchronization rules have been created for your basic configuration. Every entry is one synchronization rule. In the Direction dropdown, you can choose between two different types: Inbound and Outbound. Practically, we say that the Inbound and Outbound synchronization is always viewed from the metaverse perspective. In my explanations, I'll use the inboundsynchronization rules because we will find the related information there.

In the following screenshot, we can see the connected Active Directory forest (inovitdemos.ch) and that it doesn't have any services, such as Exchange or Skype for Business, and no synchronization rules have been created for these services:

Synchronization rules overview—Inbound

With the following steps, we will gather more information on the practical usage of the tool...

Special considerations in advanced synchronization concepts

In this section, we'll start using our knowledge in practical examples. First, we'll explore some essential functions that can be used out of the box. In some environments, you have the requirement that an organization has an organizational unit (OU) filter in place, where all users are included in this OU. But now that you need to filter out, this shouldn't be synchronized to the Azure AD. Furthermore, we'll integrate a second AD forest and use PowerShell to configure the synchronization rules.

Using standard filters to exclude users and groups

In this section, we'll use the standard filtering options to exclude users and groups to be synchronized to the metaverse:

1. Log in as domain administrator to your YD1ADS01.
2. Open the Active Directory Users and Computers console (dsa.msc).
3. Be sure that you are in the advanced features view:

Active Directory Users and Computers—Advanced Features option

4. Choose one of your users and move to the Attribute...

Summary

In this chapter, you learned about declarative provisioning and how synchronization rules work. We explored practical examples to learn how to use standard sync rules and how to create our own. You also learned how to use PowerShell to configure synchronization rules and block/delete attributes to and in Azure AD. With the integration of another untrusted Active Directory, you saw the standard procedure to do this and to customize your synchronization options to define precisely what should happen in your environment.

In the next chapter, we'll show you how to monitor your synchronization solution.