Azure AD – A new version of Azure AD Connect (1.6.2.4) is now available with new features

As you know Azure Active Directory Connect (AAD Connect) is used to synchronize your on-premises Active Directory objects (users, groups, devices) to Azure AD with the option to synchronize the user’s hash password (aka password sync, aka password hash sync, aka PHS).

Well, with this new version – 1.6.2.4 – available for download here https://go.microsoft.com/fwlink/?LinkId=615771 you can now configure selective PHS if you want to exclude some accounts from synchronizing the password hash to Azure AD.

To do so you will have to update an attribute (adminDescription) on your user’s Active Directory objects and edit the synchronization rules.

Depending of the number of user’s objects to exclude for the password hash synchronization, the process is a little bit different.

If the number of excluded user for PHS is smaller than the one included for PHS, then you will need to use the value PHSFiltered; otherwise (number of excluded users larger than the number of included users), then the value is PHSIncluded.

After having edited the adminDescription attribute with the value matching your requirement, you will have to stop the synchronization before editing the rule

Set-ADSyncScheduler -SyncCycleEnabled $false

Then using the Synchronization rules editor, edit the rule In from AD – User AccountEnabled and make an editable copy as prompted when editing a built-in rule

Then add a clause from the Scoping filter section to match the below condition

• Attribute: adminDescription
• Operator: equal
• Value: either PHSFiltered or PHSIncluded depending of your context (see above)

Then you can re enable the synchronization with the command

Set-ADSyncScheduler -SyncCycleEnabled $true

And finally run a full sync with the command

Start-ADSyncSyncCycle -PolicyType Initial

NOTE if the adminDescription attribute is not populated or does not have the correct value, then PHS will continue to work as before.