Filtering Microsoft Entra Connect Sync by OU, group and attribute without deleting users

"Stop syncing the service accounts OU" sounds like a two-minute job in Microsoft Entra Connect Sync. The catch is that every previously synced object that falls out of scope is deleted from Microsoft Entra ID at the next export. In this post I'll compare the filtering options, then walk through a filter change with exports paused and every pending delete reviewed before anything is exported.

How filtering works#

Filters combine with a logical AND, and with several forests you configure each one. Keep two facts in mind:

• Out of scope means deleted. Objects that leave scope are deleted in Microsoft Entra ID. Connect only deletes objects that it once had in scope.
• Users can come back; groups can't. If a filter mistake reaches the cloud, removing the filter and syncing again restores users from the Microsoft Entra recycle bin. Other object types can't be undeleted: a security group that granted access to a resource is gone, and so is that access.

Prerequisites#

• An account in the ADSyncAdmins group on the sync server, plus a Hybrid Identity Administrator account for the wizard.
• A fresh configuration export (View or export current configuration in the Connect wizard) so you can roll back.
• Ideally a staging server to rehearse on. Changes don't replicate between servers, so you'll repeat them on each one.

Step 1: Stop exports before you change anything#

Microsoft's guidance is to disable the scheduler (which otherwise runs a cycle every 30 minutes) or put the server in staging mode before you change filtering:

Import-Module ADSync
Set-ADSyncScheduler -SyncCycleEnabled $false
Get-ADSyncScheduler | Select-Object SyncCycleEnabled, StagingModeEnabled

A staging server doesn't need the scheduler paused, because it exports nothing. After the change, just run Start-ADSyncSyncCycle -PolicyType Initial there. That's the safest rehearsal.

Step 2: Make the filter change#

OU filtering in the wizard#

1. Open Microsoft Entra Connect, choose Customize synchronization options and sign in.
2. On Domain and OU filtering, choose Sync selected domains and OUs, then clear the OUs you want out (or select new ones).
3. On Ready to configure, clear Start the synchronization process when configuration completes so nothing runs before you've reviewed it.

Attribute filtering with the Synchronization Rules Editor#

The "do not sync these" pattern is the easiest to maintain:

1. Open Synchronization Rules Editor, keep Inbound selected and choose Add new rule.
2. Name it (for example In from AD – User DoNotSyncFilter). Select your forest, user as the CS object type, person as the MV object type and link type Join. Give it an unused precedence below 100, such as 50.
3. Under Scoping filter, add a group and a clause: extensionAttribute15 EQUAL NoSync.
4. Leave Join rules empty.
5. Add a transformation: FlowType Constant, target attribute cloudFiltered, source True. Save.

cloudFiltered should only ever be True or empty. The exception is Microsoft's documented "only sync these" pattern, which pairs a rule that sets it to False with a catch-all rule that sets it to True. That pattern overrides the default filter, so your scope must still keep out critical system objects, replication conflict objects, special mailboxes and Connect's own service accounts. Never edit the out-of-box rules: clone the rule, disable the original and edit the clone.

Step 3: Run the sync steps and review pending exports#

An OU or domain change needs a Full Import followed by a Delta Synchronization on the AD connector. A new or changed sync rule needs a Full Synchronization. In Synchronization Service Manager, select the connector under Connectors, choose Run and pick the profile. Wait until the connector shows Idle before you start the next one. Then dump what would be exported to Microsoft Entra ID:

cd /d "%ProgramFiles%\Microsoft Azure AD Sync\bin"
REM Use the exact Microsoft Entra connector name shown in Synchronization Service Manager
csexport "contoso.com - Microsoft Entra ID" %temp%\export.xml /f:x
CSExportAnalyzer %temp%\export.xml > %temp%\export.csv

Open the CSV in Excel and filter for deletes. Good looks like this: every delete is an account you meant to remove, and the count matches your estimate. For a visual check, use Search Connector Space on the Microsoft Entra connector with the scope set to Pending Export and Delete ticked. If anything surprises you, fix the filter and repeat.

Step 4: Export, and handle the deletion threshold#

Run Export on the Microsoft Entra connector. If the pending deletes exceed the accidental-delete threshold (500 by default), the run stops with stopped-deletion-threshold-exceeded, and Connect Health raises an alert. Lift the protection only when the review proved every delete is intended:

Get-ADSyncExportDeletionThreshold
Disable-ADSyncExportDeletionThreshold
# Run Export on the Microsoft Entra connector again, then restore protection
Enable-ADSyncExportDeletionThreshold -DeletionThreshold 500
Set-ADSyncScheduler -SyncCycleEnabled $true

These cmdlets may prompt you to sign in with a Hybrid Identity Administrator account.

Verify#

• Get-ADSyncScheduler shows SyncCycleEnabled : True again.
• On the Operations tab, the export succeeded and its delete count matches your CSV.
• In the Microsoft Entra admin center, Entra ID › Users › Deleted users lists only the accounts you expected.
• For an attribute filter, the filtered object's Lineage tab in the connector space shows your rule.

Tips and gotchas#

• Moving off group-based filtering? Build and preview the OU or attribute filters first, then turn group filtering off in the wizard. You can't turn it back on.
• Filtering survives upgrades, but check it before the first cycle on a new version; see keeping Connect Sync supported.
• Send the deletion-threshold alert to a mailbox someone reads; see Connect Health alerts.
• Deleted users stay in the recycle bin for 30 days, so act quickly if a mistake does get through.

References#

• Microsoft Entra Connect Sync: Configure filtering