Which Active Directory Groups Does Azure AD Connect Sync?
Question details
The user is seeking clarification on whether Azure AD Connect synchronizes domain local, universal, and global security groups.
- Product
- Microsoft Entra ID / Azure AD Connect
- Device & OS
- not provided
- Scenario
- Administering group synchronization between on-premises Active Directory and Azure AD.
- Observed behavior
- Seeking specific guidance on synchronization scopes, directory extension rules, and writeback settings for various AD group types.
Ensure you have administrative access to your on-premises Active Directory server and your Microsoft Entra ID (Azure AD) portal to review your synchronization configuration.
Review Synchronization Scope and Group Settings
Azure AD Connect can synchronize domain local, universal, and global security groups, but the exact behavior depends entirely on your configured synchronization scope and filtering rules.
By default, Azure AD Connect synchronizes all users and groups. However, administrators often apply Domain and Organizational Unit (OU) filtering to limit exactly what data moves to Microsoft Entra ID.
To verify which groups are included in your deployment, you must check the active synchronization settings on your Azure AD Connect server.
Log into the server hosting Azure AD Connect and open the Azure AD Connect wizard.
Click on 'View or customize synchronization options' and proceed through the wizard to the 'Domain and OU filtering' page.
Check which Domains and Organizational Units (OUs) are selected for synchronization. Ensure the OUs containing your domain local, universal, and global groups are checked.
Because Azure AD deployments require highly specific technical guidance, post your advanced configuration questions to the Microsoft Q&A forum under the Microsoft Entra ID category for dedicated support.
Boost Your IT Productivity with WPS Office
While managing complex enterprise IT infrastructure like Microsoft Entra ID and Active Directory, you need reliable, fast, and cost-effective daily software. WPS Office is a highly compatible, lightweight, and free alternative to Microsoft Office, supporting all major document formats seamlessly.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the installer. The lightweight design ensures a fast setup process without burdening system resources.
- 3. Open Your Documents: Launch WPS Office and instantly open, edit, and save your existing Microsoft Office files with perfect formatting preservation.
Frequently Asked Questions
Can I filter which Active Directory groups sync to Azure AD?
Yes, administrators can restrict synchronization by using Domain-based filtering, Organizational Unit (OU) filtering, or attribute-based filtering within the Azure AD Connect wizard.
Are Domain Local groups synchronized to Microsoft Entra ID?
Yes, Azure AD Connect is capable of synchronizing Domain Local groups to Entra ID, provided those groups reside within an Organizational Unit that is included in the synchronization scope.
Where can I get dedicated support for Azure AD Connect deployment issues?
For dedicated technical support regarding Azure Active Directory and Entra ID deployments, it is recommended to post your inquiries in the Microsoft Q&A forum using the Microsoft Entra ID tag.
