The Azure AD Connect’s synchronisation feature has the following components
On- Premise component- This component is called the Azure AD Connect Sync or the Sync Engine
Residing service in Azure AD- It is also known as Azure AD Connect sync service.
The settings for Azure AD Connect is configured with Azure Active Directory Windows Powershell module. It has to be downloaded and installed separately from Azure AD Connect.
You need to run Get-MsolDirSyncFeatures. To check the configuration of your Azure AD Directory
The following settings can be configured by Set-MsolDirSyncFeature:
After you have enabled a feature, it cannot be disabled again.
Duplicate attribute resiliency
It is default enabled in Azure AD Directories. A temporary value is assigned to the duplicated attribute which helps stop failure of provisioning objects with duplicate proxyaddresses or UPNs. As soon as the conflict is resolved, UPN is modified to the appropriate value automatically.
UserPrincipalName soft match
On enablement of this feature, in addition to primary SMTP address UPN soft match is enabled. Soft match is used for matching existent Azure AD cloud users with users on-premise. This feature is specifically helpful for matching on-premise Azure AD accounts with already existing accounts, when Exchange Online is not being used by you. This feature negates the need for setting up SMTP attribute in the cloud. The feature is default enabled for newly formed Azure directories
Get-MsolDirSyncFeatures -Feature EnableSoftMatchOnUpn
If this feature is not default enabled for Azure AD directory, you can run the following script to enable it
Set-MsolDirSyncFeature -Feature EnableSoftMatchOnUpn -Enable $true
Synchronize userPrincipalName updates
It allows synchronisation os UPN changes for federated accounts. Using the Azure AD Connect sync service for making updates to the attribute of UserPrincipalName, on-premise has been stopped unless the following conditions are met
- It is a non-deferated account (user is managed)
- License has not been assigned to the user.
By enabling Synchronize Username principle feature, you are able to use the sync engine to update userprinciple name when it is modified on-premises
This feature is default enabled for newly formed Azure AD directories. You can run the following script to check whether the feature is enabled
Get-MsolDirSyncFeatures -Feature SynchronizeUpnForManagedUsers