Question
Your on-premises network contains a single-domain Active Directory Domain Services (AD DS) forest. You have an Azure AD tenant named contoso.com. The AD DS forest syncs with the Azure AD tenant by using Azure AD Connect.
You need to ensure that users in the forest that have a custom attribute of NoSync are excluded from synchronization.
How should you configure the Azure AD Connect cloudFiltered attribute, and which tool should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Attribute: True — cloudFiltered is the reserved attribute the Azure AD Connect sync engine checks on each metaverse/connector-space object, and setting it to True marks that object as filtered so it is never exported to Azure AD; you would therefore write a rule that evaluates the custom NoSync attribute and sets cloudFiltered = True for matching users. Null is the value that means "not filtered" (the object syncs normally), and Microsoft's guidance is to use True or NULL only — never False — because an explicit False can conflict with other rules that try to filter the same object.
Tool: Synchronization Rules Editor — cloudFiltered is not an Active Directory attribute you can stamp on the user object; it only exists inside the Azure AD Connect sync engine, so it must be populated by a custom inbound synchronization rule with a scoping filter and an attribute-flow expression, which is authored in the Synchronization Rules Editor that ships with Azure AD Connect. ADSI Edit only edits real AD DS attributes and cannot create sync rules, and the Azure AD Connect wizard supports only domain-, OU-, and group-based filtering, not attribute-based filtering on a custom attribute.
