Explanation:
User1 syncs to Azure AD: # Yes
* User2 syncs to Azure AD: # No
* Group2 syncs to Azure AD: # No
This scenario is directly covered in the Microsoft SC-300: Identity and Access Administrator exam section
"Implement Azure AD Connect synchronization" and detailed in Microsoft documentation: "Azure AD Connect: Configure filtering" .
Azure AD Connect supports multiple filtering mechanisms:
* Domain and Organizational Unit (OU) filtering - only objects in selected OUs are synchronized.
* Group-based filtering (Pilot sync) - when enabled, only members of the specified security group (and required dependency objects) are synchronized. Nested groups are not supported.
* OU Filtering:
* Both OU1 and OU2 are selected.
* Therefore, objects in both OUs are eligible for synchronization (if other filters allow).
* Group-based filtering:
* The selected filter group is Group1, located in OU2.
* Azure AD Connect synchronizes only direct members of Group1 (users, groups, or devices).
* Nested groups are ignored - their members are not recursively synchronized .
* User1:
* Is a direct member of Group1 (in OU1).
* Since User1 is directly in Group1, and OU1 is included, User1 will sync to Azure AD. # User1 syncs to Azure AD = Yes
* User2:
* Is not a member of any group.
* The Group1-based filtering excludes non-members, even though OU1 is selected. # User2 syncs to Azure AD = No
* Group2:
* Is a member of Group1, but nested groups are ignored in Azure AD Connect group-based filtering.
* Thus, Group2 itself and its members will not be synchronized. # Group2 syncs to Azure AD = No Based on the exhibits: Evaluating Each Object: Supporting Microsoft Documentation (from SC-300 material):
"When you use group-based filtering, only objects that are direct members of the specified group are synchronized. Nested group memberships are ignored."
"If you select specific OUs for synchronization, objects must meet both the OU filtering and the group filtering criteria to be included in the sync."