I've been considering whether to sync our whole on-premises Active Directory (AD) to Microsoft Entra ID using Azure AD Connect, as suggested by our Managed Service Provider (MSP). They believe it's simpler and will future-proof our setup. However, we're currently only syncing the Organizational Unit (OU) that contains our user accounts. The reasons for this are: we need to sync mail-enabled users for Exchange Online, syncing only the relevant OU helps keep our licensing dashboard cleaner, and we want to avoid cluttering Entra with service accounts, disabled users, or legacy objects that may cause compliance issues. I understand the benefits of a full sync—less filtering, fewer surprises—but it feels unnecessary and messy for our situation where selective sync provides us more control and less overhead. I'm curious how others manage this: are you doing full sync, syncing just user accounts, or applying some kind of filtering? Any regrets or issues with full sync?
4 Answers
Totally agree! Full sync can be a security nightmare. It doesn't sound like your current setup is flawed; in fact, it's best practice to sync only what you strictly need, like user accounts and necessary groups. Trust me, too much data in Entra creates more problems.
I wouldn't recommend a full sync. It's better to avoid syncing service accounts and privileged accounts to Entra, as those could lead to security risks. Keeping your sync limited helps maintain a clean and secure environment.
Your MSP's suggestion seems a bit lazy. Just ask them how syncing everything helps your organization? More often than not, it just adds unnecessary clutter and can increase the risk of errors or breaches. Stick with selective sync.
I work in an organization that also only syncs specific OUs, usually just user and device OUs. This helps us avoid syncing those legacy or unnecessary objects. Full sync just complicates management and can lead to compliance headaches. You’ve got the right idea!
Exactly! It's easier for them to tell you to sync everything than to understand your specific needs. Selective sync gives you much better control!