Entra Connect Sync Soft Delete

Question

In our environment we are slowly rolling out MS365 and want to utilize entra and the rest of the admin centers. In a previous job I worked every day in ms admin center. However now I am setting up a test environment with pairing our domain to our tenant and setting up entra connect.

I had initially set it up what I thought was successfully in a custom install (not express) but was stumped on the Filter Groups section. I clicked 'all users and devices'. I assumed that meant it would sync the users in the test OU I chose in the OU filter. Nope. It eventually synced everything - my guess was due to syncing all groups and the members, contacts, devices that were part of those groups. I deleted over 500 users in Entra and they showed right back up. I even unable to delete groups.

So, I uninstalled and reinstalled the entra connect. Set it up with a test ou and test group this time. However, all of the users, contacts etc still show in Entra. How long will it take for the wizard to see only the users and group in the scope and soft delete the rest?I have ensured the OU is only chosen in the sync service manager. When I force a resync and check in sync service manager, I'll see XXX number of disconnectors from the cloud connector but nothing in pending deletion.

I feel I'm missing something pretty simple. I've tested password changes in AD and it syncs to Entra and office apps for test users - so that is working. I just want to clean up the Entra so after I clean up AD, I can then sync more OUs and groups. Of our 300 users, only 20 or so will have licenses. the rest will be IDs used for sspr, mfa etc.

Answer 1

Hello @DMC,

Thank you for connecting offline for discussing the issue.

Based on your question, currently you want to delete and clean-up your Entra ID of the objects which were previously synced by mistake as well as the objects which were showing in disconnected state.

We have followed the below process:

1. Disable the directory sync: We followed the document Turn-off-directory-synchronization to disable the sync from on-prem to Entra, once we have executed the PowerShell commands, the objects will turn into cloud only objects and can be managed through Entra ID.
2. Once we have confirmed that Get-MgOrganization | Select OnPremisesSyncEnabled is false, we deleted the objects from Entra.
3. We also deleted the objects from Deleted users/group to avoid any soft match after enabling the Directory sync.
4. Once the complete deletion has been completed, we can re-enable directory sync and configure OU filtering as required.

If you have any further questions or queries, please do let us know.

Answer 2

In scenarios where you are synchronizing from on-premises AD, you should be deleting the objects in your on-premises environment, not directly in Entra. As you've noted above, in the latter scenario objects will just be recovered. After the reinstall, you likely ended up in a scenario where the object's connection to on-premises is broken, i.e. they are now "disconnectors", which means you should be able to delete them directly from the cloud. Just in case, make sure to first force a full sync for a proper cleanup: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-feature-scheduler#full-sync-cycle