3.1 Microsoft Entra Connect Sync Architecture, Installation & Filtering
Key Takeaways
- Entra Connect Sync moves objects through a three-tier pipeline: a Connector Space per connected directory, a central Metaverse that consolidates identities, and outbound provisioning into Microsoft Entra ID.
- Express Settings requires a single AD forest with fewer than 100,000 objects, installs SQL Server Express LocalDB, and enables Password Hash Synchronization plus password writeback by default.
- Custom installation is mandatory for multi-forest topologies, an existing full SQL Server instance, alternate sign-in identifiers, or non-default sync options.
- Scoping filters can be applied by domain, by organizational unit, or by attribute value; OU filtering is the most common and lowest-risk method for excluding service and test accounts.
- Filtering must be planned before the first sync cycle, because removing objects from scope later deletes their cloud counterparts and any cloud-only data attached to them.
Microsoft Entra Connect Sync Architecture & Deployment
In a hybrid enterprise infrastructure, directory synchronization forms the foundational bridge connecting on-premises Active Directory Domain Services (AD DS) forests with Microsoft Entra ID (formerly Azure Active Directory). Microsoft Entra Connect Sync is the on-premises application designed to bridge this gap, ensuring that identities, security groups, credential hashes, and directory attributes remain continuously synchronized between physical domain controllers and the Microsoft cloud.
Mastering the internal architecture, database dependencies, anchor attribute mechanics, and troubleshooting tools of Entra Connect Sync is critical for the AZ-800 exam and for designing resilient hybrid enterprise architectures.
1. Entra Connect Sync Internal Architecture
Microsoft Entra Connect Sync operates as an identity broker utilizing a state-based synchronization pipeline. Rather than streaming changes directly from on-premises LDAP to the Microsoft Graph API, the sync engine processes directory data through staging areas and a consolidated identity repository.
+-----------------------------------------------------------------------------------+
| MICROSOFT ENTRA CONNECT SYNC PIPELINE & DATA FLOW |
| |
| [On-Premises AD DS] [Microsoft Entra] |
| | ^ |
| | (LDAP / RPC) | (Graph)|
| v | |
| +--------------------+ +----------------+ |
| | AD DS Connector | | Entra Connector| |
| | Space (CS) | | Space (CS) | |
| +--------------------+ +----------------+ |
| | ^ ^ | |
| | Inbound | Export Export | | |
| | Rules | (Password/Attr) (Push) | | |
| v | | v |
| +------------------------------------------------------------------------------+ |
| | METAVERSE | |
| | - Unified Object Repository (Users, Groups, Contacts) | |
| | - Attribute Precedence & Rule Engine | |
| | - Global Anchor Binding (mS-DS-ConsistencyGuid <-> ImmutableID) | |
| +------------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------+
The Three Architectural Components:
- Connector Spaces (CS): A staging storage area maintained for each connected directory. There is an AD DS Connector Space representing on-premises objects and a Microsoft Entra Connector Space representing cloud directory objects. The connector space mirrors the raw, un-transformed state of the connected directory.
- Metaverse (MV): The unified, centralized identity table. The Metaverse aggregates attributes from multiple connector spaces into a single holistic identity representation (e.g., combining a user's on-premises telephone number with an Exchange Online mailbox property).
- Synchronization Engine & Rule Pipeline: Executes three distinct synchronization phases:
- Import: Reads raw object changes from the source directory into its respective Connector Space.
- Synchronization: Evaluates Inbound Synchronization Rules to project or join CS objects into the Metaverse, applies attribute precedence, and evaluates Outbound Synchronization Rules to stage changes from the Metaverse into the target Connector Space.
- Export: Pushes staged attribute modifications, creations, and deletions from the target Connector Space to the external directory (e.g., uploading new user accounts to Microsoft Entra ID via Graph REST APIs).
Database Backend Sizing:
- SQL Server Express / LocalDB: Installed automatically during Express installation. It has a strict 10 GB database size limit, which supports up to 100,000 directory objects. If the database reaches 10 GB, the sync engine halts with database full errors.
- Full SQL Server (Standard / Enterprise): Mandatory for enterprise deployments managing >100,000 objects, or environments requiring high-availability SQL Always On availability groups, clustered database instances, or custom remote SQL placement.
2. Installation Modes: Express Settings vs. Custom Installation
Choosing the correct installation mode determines how directory credentials, database placement, authentication, and anchor attributes are configured.
| Installation Dimension | Express Settings | Custom Installation |
|---|---|---|
| Target Topology | Single Active Directory forest only | Multi-forest, multi-domain, or complex topologies |
| Object Sizing | < 100,000 objects | Up to millions of objects (with Full SQL) |
| Database Engine | SQL Server 2019/2022 Express LocalDB (local) | Existing remote/local Full SQL Server or SQL Express |
| Authentication Mode | Password Hash Synchronization (PHS) | PHS, Pass-through Auth (PTA), AD FS Federation, or PingFederate |
| SourceAnchor | Auto-configured (mS-DS-ConsistencyGuid) | Admin-selectable (mS-DS-ConsistencyGuid or custom attribute) |
| Filtering Options | Syncs all domains and all OUs | Granular Domain, OU, and Attribute filtering |
| Staging Mode | Disabled (immediate live production sync) | Configurable as an active server or Staging Mode server |
[!IMPORTANT] Express Settings Account Requirements: Running Express Settings requires an on-premises Enterprise Admin account (to automatically create the
MSOL_directory synchronization account with required replication permissions in AD DS) and a cloud Hybrid Identity Administrator or Global Administrator account.
Directory Filtering Mechanisms in Microsoft Entra Connect Sync
| Filtering Type | Configuration Location | Operational Behavior & Exam Notes |
|---|---|---|
| Domain-Based Filtering | Entra Connect Configuration Wizard | Excludes entire Active Directory domains from the sync scope. Unchecked domains never enter the AD DS Connector Space. |
| OU-Based Filtering | Entra Connect Configuration Wizard | The recommended standard for production. Only selected Organizational Units are imported into the Connector Space. Objects moved into an unselected OU are deleted from Entra ID on the next sync cycle (placed in Entra ID Recycle Bin for 30 days). |
| Attribute-Based Filtering | Synchronization Rules Editor | Uses custom inbound sync rules to evaluate object attributes (e.g., checking if extensionAttribute15 equals NoSync or adminDescription contains DoNotSync). Sets the internal cloudFiltered = True attribute in the Metaverse. |
| Group-Based Filtering | Initial Wizard Installation Only | Pilot deployments only. Filters synchronization based on membership in a single specified security group. Exam Trap: Group-based filtering cannot be re-enabled after initial setup, does not support nested groups, and is officially unsupported for ongoing production synchronization. |
A system administrator has deployed Microsoft Entra Connect Sync using Express Settings. Two months later, the company acquires an organization with 150,000 user objects in a separate Active Directory forest. The administrator needs to synchronize the new forest and add custom attribute transformations. Which set of actions must be performed?