ADToAADSyncServiceAccount @nzzz.com - User created

Question

Hi Team,

I’ve installed the Provisioning Agent on the server to enable account creation in Active Directory using API-driven inbound provisioning. However, I’ve noticed that accounts are also being created in Entra ID simultaneously. I suspect this is due to the following account:

ADToAADSyncServiceAccount**@xxxx.onmicrosoft.com]**

We are already using Azure AD Connect to synchronize users from on-premises AD to Entra ID, so I do not want the Provisioning Agent to interfere with this process or create users directly in Entra ID.

How can I configure the setup to ensure that the Provisioning Agent only creates accounts in Active Directory and does not affect Entra ID or duplicate user creation?

Thanks,

Vidisha

Answer 1

Hello @Khedkar, Vidisha

Thank you for posting on Q&A Forum.

As per my understanding, Cloud Sync is syncing users to Entra ID which is creating duplicate entries.

By Default, all the objects would be synced. To stop the users from automatically syncing to Entra ID apply the scope to only specific OU's. By following the below steps you can scope only specific OU's stopping duplicate entries.

1.Go to Azure Portal and Cloud Sync. Click "All users" to the right of "Scope users"

2.Select "Selected Organizational Units" and enter an OU you wish to add to the provisioning scope

3.Click "Add" and you will see the OU added to the provisioning scope.

4.Save this configuration and the provisioning scope will then be set to the specified OUs.

ADToAADSyncServiceAccount**@xxxx.onmicrosoft.com] is a service account which is created by default at the backend and helps in syncing the objects using cloud sync.

https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/how-to-configure

It is recommended to use one synchronization tool either Entra ID Connect or Cloud Sync for any given user or group to avoid duplicates.

I hope this information is helpful. Please feel free to reach out if you have any further questions.