Directory synchronization scoping is something supported through the DirSync tool at the following levels: Domain-based. You can use this filtering type to manage the properties of the source AD management agent (connector) in the DirSync tool. This type enables you to select which domains are allowed to synchronize to the cloud. Organizational unit–based. You can use this filtering type to manage the properties of the source AD management agent (connector) in the DirSync tool. This filtering type enables you to select which OUs are allowed to synchronize to the cloud. User attribute–based. You can use this filtering method to specify attribute-based filters for user objects (and user objects only). This enables you to control which objects should not be synchronized to the cloud. Important note Preventing the replication of certain attributes to Azure AD is not supported with the DirSync tool. All attributes must be part of the scope. See the related instructions to completely setup the directory synchronization for your domain(s) within your Azure AD directory tenant. Considering first the Azure AD Connect tool As previously mentioned, the DirSync tool was intended for on-premises AD single-forest scenarios. However, many customers are operating with more than one on-premises Active Directory forest for a variety of reasons, such as: Multiple account forests, where user accounts exist in multiple Active Directory forests; Account and resource forests, where the Exchange organization is typically hosted in a resource forest model. Multi-forest topologies can be supported through the Azure AD Sync tool initially released in September 2014. This tool that was considered as the successor of DirSync is flexible, and can accommodate most Active Directory and Exchange multi-forest scenarios: Single Account Forests, single or multiple Exchange resource forest(s). Multiple Account Forests, with no on-premises Exchange. Multiple Account Forest, single or multiple Exchange resource forest(s). Note For additional information, see the Microsoft MSDN article . This is an awaited feature was that previously only available with the and Microsoft Forefront Identity Manager (FIM) 2010 R2. Beyond this key characteristic, Azure AD Connect includes a rich set of sync and write-back capabilities: Enable your users to perform self-service password reset in the cloud with write-back to AD. Enable provisioning from the with user write back to on-premises AD. Enable write back of “Groups in Office 365” to on-premises distribution groups in a forest with Exchange.
Directory synchronization scoping is something supported through the DirSync tool at the following levels: Domain-based. You can use this filtering type to manage the properties of the source AD management agent (connector) in the DirSync tool. This type enables you to select which domains are allowed to synchronize to the cloud. Organizational unit–based. You can use this filtering type to manage the properties of the source AD management agent (connector) in the DirSync tool. This filtering type enables you to select which OUs are allowed to synchronize to the cloud. User attribute–based. You can use this filtering method to specify attribute-based filters for user objects (and user objects only). This enables you to control which objects should not be synchronized to the cloud. Important note Preventing the replication of certain attributes to Azure AD is not supported with the DirSync tool. All attributes must be part of the scope. See the related instructions to completely setup the directory synchronization for your domain(s) within your Azure AD directory tenant. Considering first the Azure AD Connect tool As previously mentioned, the DirSync tool was intended for on-premises AD single-forest scenarios. However, many customers are operating with more than one on-premises Active Directory forest for a variety of reasons, such as: Multiple account forests, where user accounts exist in multiple Active Directory forests; Account and resource forests, where the Exchange organization is typically hosted in a resource forest model. Multi-forest topologies can be supported through the Azure AD Sync tool initially released in September 2014. This tool that was considered as the successor of DirSync is flexible, and can accommodate most Active Directory and Exchange multi-forest scenarios: Single Account Forests, single or multiple Exchange resource forest(s). Multiple Account Forests, with no on-premises Exchange. Multiple Account Forest, single or multiple Exchange resource forest(s). Note For additional information, see the Microsoft MSDN article . This is an awaited feature was that previously only available with the and Microsoft Forefront Identity Manager (FIM) 2010 R2. Beyond this key characteristic, Azure AD Connect includes a rich set of sync and write-back capabilities: Enable your users to perform self-service password reset in the cloud with write-back to AD. Enable provisioning from the with user write back to on-premises AD. Enable write back of “Groups in Office 365” to on-premises distribution groups in a forest with Exchange.
An-overview-of-AAD.docx