\nSo the process of installing and configuring a DirSync is quite simple when you follow the available Guidelines. It is well described and really depends on your needs and Infrastructure (Multi Forest Design etc.) where and what kind of Software you need to install. But be aware of the last Screen, when you run the Windows Azure Active Directory Sync tool Configuration Wizard:
\n
![\"End](\"http:\/\/hosebei.wordpress.com\/wp-content\/uploads\/2014\/01\/azuredirsync01.png\")
<\/a>\nBe sure that you have unchecked the “Synchronize your directories now” box, otherwise the entire Directory will be synchronized. You can sync the directories afterwards through powershell or running the wizard again. Because after the configuration is done through the wizard, the initial configuration is not as what we need, so we don’t want to sync.
\nTo modify the initial configuration, navigate to the Installation path of the DirSync tool, and start miisclient.exe:
\n“C:Program FilesWindows Azure Active Directory SyncSYNCBUSSynchronization ServiceUIShellmiisclient.exe”
\nThis will open the Forefront Identity Manager Console, where you can check the config, and change it if wanted. The most common change is to select one or more specific Organizational Unit to sync with Azure Directory. You can achieve this, by clicking on “Management Agents”:
\n
![\"FIM](\"http:\/\/hosebei.wordpress.com\/wp-content\/uploads\/2014\/01\/azuredirsync02.png\")
<\/a>\nIn the list of the Management agents, double-click the “Active Directory Connector” entry:
\n
![\"Active](\"http:\/\/hosebei.wordpress.com\/wp-content\/uploads\/2014\/01\/azuredirsync03.png\")
<\/a>\nThis will open the properties of this connector, and you have to navigate to “Configure Directory Partitions” and click on the “Containers …” button:
\n
![\"FIM](\"http:\/\/hosebei.wordpress.com\/wp-content\/uploads\/2014\/01\/azuredirsync04.png\")
<\/a>\nYou will be asked for Domain credentials, the account which is shown was created when the wizard was run, thus you don’t know the Password. But you can simply use your credentials to connect to the AD. After this authentication, the following window is shown, where you can select or deselect OUs:
\n
![\"Select](\"http:\/\/hosebei.wordpress.com\/wp-content\/uploads\/2014\/01\/azuredirsync05.png\")
<\/a><\/p>\nAn other way to reduce the number of synced object is to exclude objects based on an Attribute. For this, you have to navigate to “Configure Connection filter” and select the object which you want to configure, in my case “user” and click on “new”: Now you have set your Definition of what will be synchronized. Now we come to the which attributes part. So, the most important things are configured now, you can start your synchronization, as said, you can go through the wizard again, or use powershell: Hope this helps someone \ud83d\ude42 When you are implementing Windows Intune with SCCM, you always come to the Point, where you got to install Azure Directory Synchronization, otherwise you will need to create your user account manually, and the users have also to manage two Passwords for their user account, one for on-premise and one for the cloud. Two big […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-1241","post","type-post","status-publish","format-standard","hentry","category-byod"],"_links":{"self":[{"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=\/wp\/v2\/posts\/1241","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1241"}],"version-history":[{"count":0,"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=\/wp\/v2\/posts\/1241\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1241"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1241"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.hosebei.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1241"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n<\/a>
\nYou might recognize that there are already some entries in this list. In the “Filter for user” wizard, choose your Attribute, in my case “ExtensionAttribute13”, and define the rule “Equals NotForNSA”. All accounts that match this rule, will not be synced to Azure Directory:
\n<\/a>
\nClick on “Add Condition” and Close the Windows by clicking on OK twice.<\/p>\n
\nLet me say first, when you look at the list for the first time, it’s quite amazing how many attributes are selected by Default, but really necessary are only a few. I would not recommend to deselect some attributes. But if you want to, you can, except these 5:
\n-cn
\n-member (applies only to groups)
\n-samAccountName (applies only to users)
\n-alias (applies only to groups and contacts)
\n-displayName (for groups with an mail or proxyAddresses attribute populated)
\nRefer to this article for more Information about the attributes: http:\/\/support.microsoft.com\/kb\/2256198\/en-us
\nThis article contains also Information about the Attribute used in an Exchange Hybrid deployment, and which Attribute are used for read only, and which one are also written back from the Azure Directory to the On-Premise.
\nYou can also get those Information by looking at the “Configure Attribute Flow” section in this wizard (As example a small list from the user):
\n<\/a><\/p>\n
\nAdd-PSSnapin Coexistence-Configuration
\nStart-OnlineCoexistenceSync<\/code>
\n<\/a>
\nYou should receive a success Status on your operation, see Picture above.<\/p>\n
\nMartin<\/p>\n","protected":false},"excerpt":{"rendered":"