If there is, it will default to the objectGUID attribute. When the Let Azure AD manage the source anchor option is selected, Azure AD Connect checks if there is a previous (older) Azure AD Connect installation connected to the Azure AD tenant. It provides the default option to Let Azure AD manage the source anchor and a list of available attributes to use as an alternative through the Choose a specific attribute option.
The above screenshot is a screenshot of a recent versions of Azure AD Connect. The Azure Active Directory Connect wizard, used to configure Azure AD Connect installations provides options to choose the source anchor attribute: To definitively match an on-premises Active Directory user object to an Azure AD user object, Azure AD Connect looks at the source anchor attribute.ĭuring normal synchronization cycles, this attribute is already used to provide the end-to-end connection between the on-premises Active Directory user object and the Azure AD user object through Azure AD Connect’s connector spaces and metaverse, so it’s an ideal way to match. If there’s no match, a new user object is created in Azure AD to correspond to the user object in the on-premises Active Directory environment. The actions are performed in the above sequence Hard matching is attempted, before soft matching is attempted. Upon provisioning an object from on-premises Active Directory to Azure AD, Azure AD performs additional actions one time, when compared to updating a user object.
To avoid this situation, Azure AD Connect matches user objects from the on-premises Active Directory to Azure AD. In Hybrid Identity implementations, where objects and their attributes are synchronized between on-premises Active Directory environments and Azure AD tenants, integrity is key When user objects on both sides have different attributes, or exist multiple times at one side, information security drops to critical levels fast.
0 kommentar(er)
