Explanation:

In Azure AD Connect-based hybrid identity, object filtering can be enforced with the built-in cloudFiltered metaverse flag. The Administering Windows Server Hybrid Core Infrastructure materials explain that
"cloudFiltered is a Boolean in the metaverse that determines whether an object is eligible for export to Azure AD; when set to True, the connector space object is excluded from synchronization to Azure AD." The recommended approach for attribute-based filtering is to create a custom inbound synchronization rule that scopes the users you want to exclude and flows a constant value of True into cloudFiltered. The guide states: "Use the Synchronization Rules Editor to define an inbound rule from Active Directory to the metaverse. Add a scoping filter (for example, a custom attribute equals 'NoSync') and configure an attribute flow mapping cloudFiltered # Constant(True). Objects matching the scope will not be exported." Because you need to exclude any user whose custom attribute equals NoSync, you create an inbound rule targeting user objects, add the scoping filter on that custom attribute, and then set cloudFiltered = True (constant). This is done with the Synchronization Rules Editor, not ADSI Edit or the Azure AD Connect wizard, since the wizard doesn't author custom attribute flows and ADSI Edit doesn't manage sync rules.