Azure AD Connect 同步:目录扩展Azure AD Connect sync: Directory extensions

通过目录扩展,可以使用本地 Active Directory 中的属性扩展 Azure AD 中的架构。You can use directory extensions to extend the schema in Azure Active Directory (Azure AD) with your own attributes from on-premises Active Directory. 此功能允许使用继续在本地管理的属性来构建 LOB 应用。This feature enables you to build LOB apps by consuming attributes that you continue to manage on-premises. 可以通过 Azure AD Graph API 目录扩展Microsoft Graph 使用这些属性。These attributes can be consumed through Azure AD Graph API directory extensions or Microsoft Graph. 可以使用 Azure AD Graph 资源管理器Microsoft Graph 资源管理器查看可用属性。You can see the available attributes by using Azure AD Graph Explorer and Microsoft Graph Explorer, respectively.

目前,没有任何 Office 365 工作负荷使用这些属性。At present, no Office 365 workload consumes these attributes.

在安装向导的自定义设置路径中配置要同步的其他属性。You configure which additional attributes you want to synchronize in the custom settings path in the installation wizard.


“可用属性”框区分大小写。The Available Attributes box is case-sensitive.


安装显示以下属性,它们是有效的候选项:The installation shows the following attributes, which are valid candidates:

  • “用户”和“组”对象类型User and Group object types
  • 单值属性:String、Boolean、Integer、BinarySingle-valued attributes: String, Boolean, Integer, Binary
  • 多值属性:String、BinaryMulti-valued attributes: String, Binary


虽然 Azure AD Connect 支持将多值 Active Directory 属性作为多值目录扩展同步到 Azure AD,但目前无法检索/使用在多值目录扩展属性中上传的数据。Although Azure AD Connect supports synchronizing multi-valued Active Directory attributes to Azure AD as multi-valued directory extensions, there is currently no way to retrieve/consume the data uploaded in multi-valued directory extension attributes.

属性列表是从安装 Azure AD Connect 期间创建的架构缓存中读取的。The list of attributes is read from the schema cache that's created during installation of Azure AD Connect. 如果已使用附加属性扩展了 Active Directory 架构,则必须刷新架构,然后这些新属性才可见。If you have extended the Active Directory schema with additional attributes, you must refresh the schema before these new attributes are visible.

Azure AD 中的对象最多可以有 100 个目录扩展属性。An object in Azure AD can have up to 100 attributes for directory extensions. 最大长度为 250 个字符。The maximum length is 250 characters. 如果属性值更长,则同步引擎会将其截断。If an attribute value is longer, the sync engine truncates it.

在安装 Azure AD Connect 期间,会注册可以使用这些属性的应用程序。During installation of Azure AD Connect, an application is registered where these attributes are available. 可以在 Azure 门户中看到此应用程序。You can see this application in the Azure portal.


这些属性带有 extension _{AppClientId}_ 前缀。The attributes are prefixed with the extension _{AppClientId}_. 对于 Azure AD 租户中的所有属性,AppClientId 具有相同的值。AppClientId has the same value for all attributes in your Azure AD tenant.

现在可以通过 Azure AD Graph API 使用这些属性。These attributes are now available through the Azure AD Graph API. 可以使用 Azure AD Graph 资源管理器查询它们。You can query them by using Azure AD Graph Explorer.

Azure AD Graph 资源管理器

另外,也可以使用 Microsoft Graph 资源管理器通过 Microsoft Graph API 查询属性。Or you can query the attributes through the Microsoft Graph API, by using Microsoft Graph Explorer.

后续步骤Next steps

了解有关 Azure AD Connect 同步配置的详细信息。Learn more about the Azure AD Connect sync configuration.

了解有关将本地标识与 Azure Active Directory 集成的详细信息。Learn more about Integrating your on-premises identities with Azure Active Directory.