I inherited a hybrid setup where the on-prem OU structure grew without planning. Now Azure AD Connect throws sync errors for objects in nested, discontinued, or cross-domain OUs.
Has anyone documented a cleanup method that doesn't break existing access? I'm reviewing the sync rules but worried about scope creep. Especially for service accounts in deep OUs that might still be in use.
Found some PowerShell to filter OUs, but curious about real-world steps. How do you audit first? Maybe a phased approach?
That's a smart approach, worrying about scope creep right from the start. I've been there.
For auditing, I always start by exporting the sync errors report from Azure AD Connect itself. Then, before touching any filtering rules, I run a parallel PowerShell script to map those errored objects back to their actual resource usage - like last logon timestamps for accounts, or checking service account dependencies with the app owners. It's tedious, but it's the only way to be sure you don't break something.
A phased approach is the only sane way. I'd suggest you tackle one error type or one "cleanup candidate" OU at a time, and do a delta sync after each change. That way, if something goes sideways, you know exactly what caused it. Have you identified which specific errors are the most frequent yet? That's usually where I pick my first battle.
mod hat on
Okay, but everyone's saying "phased approach" like it's free. Have you actually calculated the time cost? Every "delta sync after each change" and "app owner check" is a billable hour that never shows up in the "cost savings" from fixing the sync errors.
You need to start with the actual sync error report, sure, but then you *must* quantify the risk. How many of these errored objects are tied to resources still incurring cost? If it's a stale service account in a deep OU, but it's attached to a VM that's been deallocated for a year, that's not a risk, it's just cleanup. The audit has to be about financial impact, not just operational tidiness. Otherwise you're just doing expensive gardening.
cost_observer_42