Azure AD Connect PowerShell Cmdlets

Click the image!

Microsoft TechNet used to be one of the best documentation libraries in the industry. Sadly, it still is; so what’s that tell you about the industry today?

Office 365 and Azure are truly great cloud services, but the frequency of updates and new releases are a challenge for Microsoft’s own sales team to keep up with, let alone us in the field, trying to work with the stuff. As made abundantly clear by their actions (e.g. killing tech conferences, technical writer layoffs, shuttering TechNet subscriptions, and abandoning the MCM program), Microsoft doesn’t really see “the problem”.

When Microsoft shipped DirSync and then later Azure AD Sync, documentation of the associated PowerShell modules became increasingly sparse, though some cmdlets did have a help synopsis, as I discussed last year. Azure AD Connect, the current version of Office 365 and Azure Active Directory synchronization technology, has 69 cmdlets in the “ADSync” module.

Wanna take a guess at how many of these have an associated help topic? Don’t forget, this product was launched earlier this summer and is now on it’s second public release.

Zero

(Pause for effect)

So, I have listed all 69 cmdlets here, with a brief note about what I’ve found so far. Right now, most are empty, but I will fill them in as I discover their purpose and/or have more time. If you’ve got a question about one I don’t have detailed, leave a comment and I’ll try to prioritize some research for you. I haven’t checked with the Azure AD team on this, so please take my findings with a grain of salt, and hope for real support documentation to arrive soon!

NOTE: This refers to the “ADSync” module that ships with Azure AD Connect 1.0.8667.0.

Cmdlet	Add-ADSyncAADServiceAccount	My Comments
Sample Usage

Cmdlet

Add-ADSyncAttributeFlowMapping

My
Comments

Maps a source to target
attribute.

Export one of the rules
from the editor to see this and other samples.

Sample
Usage

Add-ADSyncAttributeFlowMapping `

-SynchronizationRule $syncRule[0] `

-Source @(‘mailNickname’,‘sAMAccountName’)
`

-Destination ‘cloudFiltered’
`

-FlowType ‘Expression’
`

-ValueMergeType ‘Update’ `

-Expression ‘IIF(IsPresent([isCriticalSystemObject])
|| IsPresent([sAMAccountName]) = False || [sAMAccountName] =
“SUPPORT_388945a0” || Left([mailNickname], 14) =
“SystemMailbox{” || Left([sAMAccountName], 4) = “AAD_” ||
(Left([mailNickname], 4) = “CAS_” && (InStr([mailNickname],
“}”) > 0)) || (Left([sAMAccountName], 4) = “CAS_”
&& (InStr([sAMAccountName], “}”) > 0)) ||
Left([sAMAccountName], 5) = “MSOL_” ||
CBool(IIF(IsPresent([msExchRecipientTypeDetails]),BitAnd([msExchRecipientTypeDetails],&H21C07000)
> 0,NULL)) ||
CBool(InStr(DNComponent(CRef([dn]),1),”\\0ACNF:”)>0), True,
NULL)’ `

-OutVariable syncRule

Cmdlet	Add-ADSyncConnector	My Comments
Sample Usage

Cmdlet

Add-ADSyncConnectorAnchorConstructionSettings

My
Comments

Sample
Usage

Cmdlet

Add-ADSyncConnectorAttributeInclusion

My
Comments

Sample
Usage

Cmdlet

Add-ADSyncConnectorHierarchyProvisioningMapping

My
Comments

Sample
Usage

Cmdlet	Add-ADSyncConnectorObjectInclusion	My Comments
Sample Usage

Cmdlet	Add-ADSyncGlobalSettingsParameter	My Comments
Sample Usage

Cmdlet

Add-ADSyncJoinConditionGroup

My
Comments

Used in the construction of
sync rules.

Export one of the rules
from the editor to see this and other samples.

Sample
Usage

Add-ADSyncJoinConditionGroup `

-SynchronizationRule $syncRule[0] `

-JoinConditions @($condition0[0]) `

-OutVariable syncRule

Cmdlet

Add-ADSyncRule

My
Comments

Export one of the rules
from the editor to see this and other

samples.

Sample
Usage

Add-ADSyncRule `

-SynchronizationRule $syncRule[0]

Cmdlet	Add-ADSyncRunProfile	My Comments
Sample Usage

Cmdlet	Add-ADSyncRunStep	My Comments
Sample Usage

Cmdlet

Add-ADSyncScopeConditionGroup

My
Comments

Used in the construction of
sync rules.

Export one of the rules
from the editor to see this and other samples.

Sample
Usage

Add-ADSyncScopeConditionGroup `

-SynchronizationRule $syncRule[0] `

-ScopeConditions @($condition0[0],$condition1[0],$condition2[0]) `

-OutVariable syncRule

Cmdlet	Disable-ADSyncConnectorPartition	My Comments
Sample Usage

Cmdlet	Disable-ADSyncConnectorPartitionHierarchy	My Comments
Sample Usage

Cmdlet

Disable-ADSyncExportDeletionThreshold

My
Comments

Disables the accidental deletion safety feature.

More info here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnectsync-feature-prevent-accidental-deletes/

Sample
Usage

Disable-ADSyncExportDeletionThreshold

Cmdlet	Enable-ADSyncConnectorPartition	My Comments
Sample Usage

Cmdlet	Enable-ADSyncConnectorPartitionHierarchy	My Comments
Sample Usage

Cmdlet	Enable-ADSyncExportDeletionThreshold	My Comments	Enables the accidental deletion safety feature. To verify, run Get-MsolDirSyncConfiguration.More info here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnectsync-feature-prevent-accidental-deletes/
Sample Usage	Enable-ADSyncExportDeletionThreshold

Cmdlet

Get-ADSyncAADPasswordResetConfiguration

My
Comments

I believe this is used to
report on password write-back.

Sample
Usage

Get-ADSyncAADPasswordResetConfiguration -Connector ‘demo1923.onmicrosoft.com – AAD’

Cmdlet	Get-ADSyncAADPasswordSyncConfiguration	My Comments	Indicates whether or not password hash sync is enabled (SYNC)
Sample Usage	Get-ADSyncAADPasswordSyncConfiguration -SourceConnector ‘laptop.lab’

Cmdlet	Get-ADSyncConnector	My Comments	Gets the management agents (connectors) used by the sync service.
Sample Usage	Get-ADSyncConnector

Cmdlet

Get-ADSyncConnectorHierarchyProvisioningDNComponent

My
Comments

Couldn’t get it to work

Sample
Usage

x =
Get-ADSyncConnector -Name
‘laptop.lab’

Get-ADSyncConnectorHierarchyProvisioningDNComponent -ShowHidden -Connector $x

Cmdlet

Get-ADSyncConnectorHierarchyProvisioningMapping

My
Comments

Couldn’t get it to work

Sample
Usage

$x =
Get-ADSyncConnector -Name
‘laptop.lab’

Get-ADSyncConnectorHierarchyProvisioningMapping -Connector $x

Cmdlet

Get-ADSyncConnectorHierarchyProvisioningObjectClass

My
Comments

Didn’t test: I presume it
lists the objects to be synced (e.g. people, contacts, etc)

Sample
Usage

Cmdlet	Get-ADSyncConnectorParameter	My Comments
Sample Usage

Cmdlet	Get-ADSyncConnectorPartition	My Comments
Sample Usage

Cmdlet	Get-ADSyncConnectorPartitionHierarchy	My Comments
Sample Usage

Cmdlet	Get-ADSyncConnectorTypes	My Comments
Sample Usage

Cmdlet	Get-ADSyncGlobalSettings	My Comments	Displays Global Configuration Settings.
Sample Usage	(Get-ADSyncGlobalSettings).Parameters \| Where name -eq Microsoft.SynchronizationOption.AnchorAttribute

Cmdlet	Get-ADSyncGlobalSettingsParameter	My Comments
Sample Usage

Cmdlet	Get-ADSyncRule	My Comments	Lists the sync rules
Sample Usage

Cmdlet	Get-ADSyncRunProfile	My Comments
Sample Usage

Cmdlet

Get-ADSyncSchema

My
Comments

Sample
Usage

Cmdlet	Get-ADSyncServerConfiguration	My Comments
Sample Usage

Cmdlet	New-ADSyncConnector	My Comments
Sample Usage

Cmdlet	New-ADSyncJoinCondition	My Comments
Sample Usage

Cmdlet

New-ADSyncRule

My
Comments

Export one of the rules
from the editor to see this and other samples.

Sample
Usage

New-ADSyncRule `

-Name ‘In from
AD – User Join’ `

-Identifier ‘c2db05cb-39bd-4e17-a19a-26718c692e48’
`

-Description ”
`

-Direction ‘Inbound’
`

-Precedence 100
`

-PrecedenceAfter ‘00000000-0000-0000-0000-000000000000’ `

-PrecedenceBefore ‘00000000-0000-0000-0000-000000000000’ `

-SourceObjectType ‘user’ `

-TargetObjectType ‘person’ `

-Connector ‘43617e64-d544-4426-9354-e7d7508915b1’
`

-LinkType ‘Provision’
`

-SoftDeleteExpiryInterval 0 `

-ImmutableTag ‘Microsoft.InfromADUserJoin.003’ `

-OutVariable syncRule

Cmdlet	New-ADSyncRunProfile	My Comments
Sample Usage

Cmdlet	New-ADSyncScopeCondition	My Comments
Sample Usage

Cmdlet	Remove-ADSyncAADPasswordResetConfiguration	My Comments
Sample Usage

Cmdlet	Remove-ADSyncAADPasswordSyncConfiguration	My Comments
Sample Usage

Cmdlet	Remove-ADSyncAADServiceAccount	My Comments
Sample Usage

Cmdlet	Remove-ADSyncAttributeFlowMapping	My Comments
Sample Usage

Cmdlet	Remove-ADSyncConnector	My Comments	Removes one of your Management Agents (Connectors)
Sample Usage

Cmdlet	Remove-ADSyncConnectorAnchorConstructionSettings	My Comments
Sample Usage

Cmdlet	Remove-ADSyncConnectorAttributeInclusion	My Comments
Sample Usage

Cmdlet

Remove-ADSyncConnectorHierarchyProvisioningMapping

My
Comments

Sample
Usage

Cmdlet	Remove-ADSyncConnectorObjectInclusion	My Comments
Sample Usage

Cmdlet	Remove-ADSyncGlobalSettingsParameter	My Comments
Sample Usage

Cmdlet	Remove-ADSyncJoinConditionGroup	My Comments
Sample Usage

Cmdlet	Remove-ADSyncRule	My Comments	Removes a sync rule.
Sample Usage

Cmdlet	Remove-ADSyncRunProfile	My Comments
Sample Usage

Cmdlet	Remove-ADSyncRunStep	My Comments
Sample Usage

Cmdlet	Remove-ADSyncScopeConditionGroup	My Comments
Sample Usage

Cmdlet	Search-ADSyncDirectoryObjects	My Comments
Sample Usage

Cmdlet	Set-ADSyncAADCompanyFeature	My Comments
Sample Usage

Cmdlet	Set-ADSyncAADPasswordResetConfiguration	My Comments
Sample Usage

Cmdlet	Set-ADSyncAADPasswordSyncConfiguration	My Comments	See details here: http://blogs.technet.com/b/undocumentedfeatures/archive/2015/11/18/reset-aadsync-or-aadconnect-password-hash-sync-configuration.aspx
Sample Usage	Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $false

Cmdlet	Set-ADSyncAADPasswordSyncState	My Comments
Sample Usage

Cmdlet	Set-ADSyncConnectorParameter	My Comments
Sample Usage

Cmdlet	Set-ADSyncGlobalSettings	My Comments
Sample Usage

Cmdlet	Set-ADSyncSchema	My Comments
Sample Usage

Cmdlet	Set-ADSyncServerConfiguration	My Comments
Sample Usage

Cmdlet	Set-MIISADMAConfiguration	My Comments
Sample Usage

Cmdlet	Test-AdSyncUserHasPermissions	My Comments
Sample Usage

Cmdlet	Update-ADSyncConnectorPartition	My Comments
Sample Usage

Cmdlet	Update-ADSyncConnectorSchema	My Comments
Sample Usage

Cmdlet	Update-ADSyncDRSCertificates	My Comments
Sample Usage

16 thoughts on “Azure AD Connect PowerShell Cmdlets”

Pingback: What are the Azure DirSync Cmdlets [Updated]? | Mike Crowley's Whiteboard
VSS says:

November 10, 2015 at 10:13 am

Thank you for the list and specifically for ‘import-module adsync’ and ‘Disable-ADSyncExportDeletionThreshold’ cmdlets! I was trying to fix ‘configured deletion threshold’ issue and got link from MSOnlineService team with link to old DirSync version of fix. Bumped on your article just in time!

Bezu Fache says:

December 9, 2015 at 2:12 am

Hi
Good work..
In Dirsync module the ps cmdet to force the sync manually is Start-onlinecoexistancesync.
What is the PS command in Azure AD Connect to force the sync manually?

- Mike Crowley says:
  
  December 9, 2015 at 8:41 am
  
  There is no cmdlet. You use DirectorySyncClientCmd.Exe (initial | delta) or force the scheduled task in Windows.
  
- Geoff Rose says:
  
  April 15, 2016 at 6:14 am
  
  you can use this command:
  Start-ADSyncSyncCycle -PolicyType Delta
  
  - Mike Crowley says:
    
    April 15, 2016 at 9:09 am
    
    In the versions since Feb 2016, yes this is the new approach.
Paul G says:

May 9, 2016 at 9:17 am

Hey! Maybe you can help me out?
I am trying to change the username for the MA for AzureAD connector. I have something like this right now…

$a = Get-ADSyncConnector -Identifier b891884f-051e-4a83-95af-2544101c9083 # MY AZURE AD CONNECTOR
Set-ADSyncConnectorParameter -Type ConnectorConnectivity -Connector $a -ParameterValues @{“Username” = “BLah@blah.com”}

- Mike Crowley says:
  
  May 9, 2016 at 11:21 am
  
  Good question. That seems to be used to build/modify connectors in memory that are then sent to the New-ADSyncConnector cmdlet. Perhaps its used to modify files like “MA-ADDSTemplate.xml”
  Maybe you cannot change the username value of a live connector with this module? You could instead go directly to SQL with sqlcmd. If you figure this out, please post back; I’ll do the same.
  
Nigel Jones says:

October 26, 2016 at 10:27 pm

Hi Mike

I am trying to clarify DR options. I am aware of having the staging server available but unclear on how we can keep the configuration in sync (sorry for the pun) with the online AADC. With MIM we could export server config rebuild and import server config (plus other .Net bits) . Is there a simple rebuild option for AADC in a DR scenario.

TIA Nigel Jones

- Mike Crowley says:
  
  October 28, 2016 at 8:51 am
  
  I haven’t worked on this myself, but it looks to be documented here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnectsync-operations/#import-and-synchronize
  
  - Nigel says:
    
    October 30, 2016 at 3:04 pm
    
    Thanks Mike
    
    The challenge with DR is as stated . The things you need to document and save are the configuration changes made to the server, such as filtering and synchronization rules. These custom configurations must be reapplied before you start synchronizing.
    
    Rgds
    Nigel
  - Nigel says:
    
    October 31, 2016 at 3:26 pm
    
    I think I have it… The sync engine has export for
    MA and MV… and SR Editor export provides the PS scripts to import the rules…
Nigel Jones says:

November 20, 2016 at 4:27 pm

Well the MA import fails on the same AADC you export from … This is probably because the MA configuration is managed during AADC setup. The MV config does import to another AADC instance – if you have any custom attributes needed. You can use the Add-ADSync files produced by the SR export function to import to another AADC if you change the connector ID’s (not needed for the AAD Connector) . Use Get-ADSyncConnector | FT Name, Identifier to get the Name and identifier for each connector

Mike Cooper says:

April 29, 2019 at 12:29 pm

The commands look great, but a different issue, we just stood up a staging sync server and during the configuration another user missed clicking on a particular OU during the filtering. We then made the staging the primary and we lost users and group membership and other issues. What I was looking for was some way to document what OU’s are chosen during the AADConnect configuration and the filtering of the OU’s Thank You

Tony T says:

August 13, 2019 at 4:43 pm

The required command-line option for ‘Get-ADSyncServerConfiguration’ is simply the target-folder for outputting the XML version of the configs, e.g.

> Get-ADSyncServerConfiguration -Path “c:\2019-08-ADsync-Config-XML”

- Mike Crowley says:
  
  August 13, 2019 at 5:09 pm
  
  Sweet, thanks! This post is pretty old. I should probably revisit it with up to date info…