After a sync settings config change to Azure AD Connect - will a new initial sync job change or delete current Azure AD user objects?

Question

I'm working with an organization that hastily setup Azure AD Connect to sync to Azure AD by setting the sync options to sync the entire domain from the ROOT level so now all objects are being synchronized up to Azure AD.

We need to clean out irrelevant objects from Azure AD and sync only scoped OUs moving forward.

Am I correct in understanding the easiest way to clean up the Azure AD objects is to simply reconfigure the Azure AD Connect sync settings to sync only specified on-prem OUs and then run a new "initial sync" job?

My concern which I seek confirmation / clarification on is what will be the actual cleansing effect of a new "initial sync" AD connect job on the current Azure AD Objects?

will it...

• delete all the current Azure AD objects and resync fresh copies of the scoped OU objects...

or will it...

• delete only those objects out of scope from the newly coped OUs and leave in scope objects as they are now?

The reason I need to know is there are products and licenses assigned in Azure AD which I need to ensure remain with the Azure AD users. If an initial sync process will delete and replace the objects on the Azure AD I will have to re-assign all the licenses which is a problem!

Or the short version of my long question above is how do I change Azure AD Connect sync scoped OUs and cleanse out only out of scope users while syncing only in scope users moving forward?

Answer 1

it will:

• delete only those objects out of scope from the newly coped OUs and leave in scope objects as they are now?

however, be aware of:

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-sync-feature-prevent-accidental-deletes

When installing Azure AD Connect, prevent accidental deletes is enabled by default and configured to not allow an export with more than 500 deletes. This feature is designed to protect you from accidental configuration changes and changes to your on-premises directory that would affect many users and other objects.