Azure AD Connect 同步:目录扩展Azure AD Connect sync: Directory extensions

通过目录扩展,可以使用本地 Active Directory 中的属性扩展 Azure AD 中的架构。You can use directory extensions to extend the schema in Azure Active Directory (Azure AD) with your own attributes from on-premises Active Directory. 此功能允许使用继续在本地管理的属性来构建 LOB 应用。This feature enables you to build LOB apps by consuming attributes that you continue to manage on-premises. 可通过扩展使用这些属性。These attributes can be consumed through extensions. 可以使用 Microsoft Graph 浏览器查看可用属性。You can see the available attributes by using Microsoft Graph Explorer.

目前,没有任何 Office 365 工作负荷使用这些属性。At present, no Office 365 workload consumes these attributes.

自定义要与 Azure AD 同步的属性Customize which attributes to synchronize with Azure AD

在安装向导的自定义设置路径中配置要同步的其他属性。You configure which additional attributes you want to synchronize in the custom settings path in the installation wizard.


“可用属性”框区分大小写。The Available Attributes box is case-sensitive.


安装显示以下属性,它们是有效的候选项:The installation shows the following attributes, which are valid candidates:

  • “用户”和“组”对象类型User and Group object types
  • 单值属性:String、Boolean、Integer、BinarySingle-valued attributes: String, Boolean, Integer, Binary
  • 多值属性:String、BinaryMulti-valued attributes: String, Binary


虽然 Azure AD Connect 支持将多值 Active Directory 属性作为多值目录扩展同步到 Azure AD,但目前无法检索/使用在多值目录扩展属性中上传的数据。Although Azure AD Connect supports synchronizing multi-valued Active Directory attributes to Azure AD as multi-valued directory extensions, there is currently no way to retrieve/consume the data uploaded in multi-valued directory extension attributes.

属性列表是从安装 Azure AD Connect 期间创建的架构缓存中读取的。The list of attributes is read from the schema cache that's created during installation of Azure AD Connect. 如果已使用附加属性扩展了 Active Directory 架构,则必须刷新架构,然后这些新属性才可见。If you have extended the Active Directory schema with additional attributes, you must refresh the schema before these new attributes are visible.

Azure AD 中的对象最多可以有 100 个目录扩展属性。An object in Azure AD can have up to 100 attributes for directory extensions. 最大长度为 250 个字符。The maximum length is 250 characters. 如果属性值更长,则同步引擎会将其截断。If an attribute value is longer, the sync engine truncates it.

向导在 Azure AD 中进行的配置更改Configuration changes in Azure AD made by the wizard

在安装 Azure AD Connect 期间,会注册可以使用这些属性的应用程序。During installation of Azure AD Connect, an application is registered where these attributes are available. 可以在 Azure 门户中看到此应用程序。You can see this application in the Azure portal. 其名称始终为“租户架构扩展应用” 。Its name is always Tenant Schema Extension App.


请确保选择“所有应用程序” 以查看此应用。Make sure you select All applications to see this app.

这些属性的前面带有扩展名 _{ApplicationId}_ 前缀 。The attributes are prefixed with extension _{ApplicationId}_. 对于 Azure AD 租户中的所有属性,ApplicationId 具有相同的值。ApplicationId has the same value for all attributes in your Azure AD tenant. 本主题中的所有其他方案都需要此值。You will need this value for all other scenarios in this topic.

使用 Microsoft Graph API 查看属性Viewing attributes using the Microsoft Graph API

通过使用 Microsoft Graph 浏览器,这些属性现在可以通过 Microsoft Graph API 获得。These attributes are now available through the Microsoft Graph API, by using Microsoft Graph Explorer.


在 Microsoft Graph API 中,你需要请求要返回的属性。In the Microsoft Graph API, you need to ask for the attributes to be returned. 按以下所示显式选择属性:$select=extension_9d98ed114c4840d298fad781915f27e4_employeeID,extension_9d98ed114c4840d298fad781915f27e4_divisionExplicitly select the attributes like this:$select=extension_9d98ed114c4840d298fad781915f27e4_employeeID,extension_9d98ed114c4840d298fad781915f27e4_division.

有关详细信息,请参阅 Microsoft Graph:使用查询参数For more information, see Microsoft Graph: Use query parameters.

后续步骤Next steps

了解有关 Azure AD Connect 同步配置的详细信息。Learn more about the Azure AD Connect sync configuration.

了解有关将本地标识与 Azure Active Directory 集成的详细信息。Learn more about Integrating your on-premises identities with Azure Active Directory.