Exam MS-102 topic 1 question 35 discussion

It should be No, No, No since group is Sales OU which does not synchronize When using OU-based filtering in conjunction with group-based filtering, the OU(s) where the group and its members are located must be included. (https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#group-based-filtering) https://www.examtopics.com/discussions/microsoft/view/82530-exam-ms-100-topic-3-question-89-discussion/

N,N,N Group1 is not in OU1.So any groups and users does not sync. Group-based filtering When using OU-based filtering in conjunction with group-based filtering, the OU(s) where the group and its members are located must be included. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-sync-configure-filtering

YYY - User1, User2, and Group2 are all in OU1. OU1 is selected to sync. The group-based filtering will not work for the SalesOU/Group1 because the SalesOU is not included in the previous page for Domain/OU filtering. Since the SalesOU was not included in the Domain/OU filtering page, it will not be synced, period. "If you plan to use group-based filtering, then make sure the OU with the group is included and isn't filtered by using OU-filtering. OU filtering is evaluated before group-based filtering is evaluated." https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-custom#sync-filtering-based-on-groups "When using OU-based filtering in conjunction with group-based filtering, the OU(s) where the group and its members are located must be included." https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-configure-filtering

In Microsoft Entra ID, filtering policies generally take precedence over domain and OU filtering, though the specific order can depend on the type of filtering and the policies in place. So Y N N

Yes No Yes User1 as OU filtering AND Group membership User2 as OU filtering but NOT in sync Group Group2 as OU filtering AND Group membership

✅ Statement Analysis: User1 syncs to Azure AD ✔️ Yes User1 is located in OU1, which is selected for sync. User2 syncs to Azure AD ✔️ Yes User2 is also in OU1, so will sync to Azure AD. Group2 syncs to Azure AD ✔️ Yes Group2 is in OU1, which is selected for sync. 🔴 Note: Even though Group2 is a member of Group1, and Group1 is in an OU not selected for sync, Group2 itself is in OU1. As a result, Group2 will sync, but Group1 will not. ✅ Final Answers: Statement Answer User1 syncs to Azure AD. ✅ Yes User2 syncs to Azure AD. ✅ Yes Group2 syncs to Azure AD. ✅ Yes

NNN is correct Sales OU is already included in filter but no member assigned to Sales OU

N N N The asnwer is here: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-configure-filtering#group-based-filtering When using OU-based filtering in conjunction with group-based filtering, the OU(s) where the group and its members are located must be included.

yes, the filter users and devices setting synchronizes only members of Group1 in Sales. no, nested group memberships are not supported for synchronization yes, Group2 is in OU1, which is selected for synchronization.

https://azurecloudai.blog/2019/10/20/field-notes-azure-active-directory-connect-domain-ou-and-group-filtering/

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-configure-filtering#group-based-filtering

It's Y N Y. View 'Group1' as if it is a Security Group which just happens to be part of the Sales OU. Microsoft is trying to trick you here into believing your devices should be a member of the Sales OU. They are in fact member of OU1, therefore they will sync (except for the second statement).

This is a botched config. OU1 is in scope but the filter targets Sales OU. Nothing will sync unless it is a member of the Sales OU. None of User1, User2 or Group2 are in the Sales OU and therefore wont sync. N/N/N is the correct answer here but the configuration is ridiculous.

It is No No No. "When using OU-based filtering in conjunction with group-based filtering, the OU(s) where the group and its members are located must be included." https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-configure-filtering#group-based-filtering

I think the answer should be User1 Yes - The user is in OU1 and in Group1 (reply to both conditions) User2 No – the syn service will check in sales OU Group 2 No – Nested group

YNY It doesn't matter Group1 is in the Sales OU. It's just used for the filter. OU1 syncs Based on filter User 1 will sync User2 to will Not sync Group 2 wil be synced because its a group in OU1 and nog a user or device. So filter does not affect the group.

User 1 is member of Group 1 and in OU1, user/device filter applies for the user so allows sync User 2 is member of group 2 and in OU1, user/device filter doesnt inlcude user so doesnt sync Group 2 is in OU1, meaning it will sync, filter is for devices/users not groups. Y,N,Y The nesting comment is saying for the targeted group, if there are members of the group that are security groups, they will be ignored. The filter is for Users/Devices.