Azure AD Connect 同步服务功能Azure AD Connect sync service features

Azure AD Connect 的同步功能有两个组件:The synchronization feature of Azure AD Connect has two components:

  • 名为 Azure AD Connect 同步的本地组件,也称为同步引擎The on-premises component named Azure AD Connect sync, also called sync engine.
  • 驻留在 Azure AD 中的服务,也称为 Azure AD Connect 同步服务The service residing in Azure AD also known as Azure AD Connect sync service

本主题说明以下 Azure AD Connect 同步服务 功能的工作原理,以及如何使用 Windows PowerShell 来配置这些功能。This topic explains how the following features of the Azure AD Connect sync service work and how you can configure them using Windows PowerShell.

这些设置通过 用于 Windows PowerShell 的 Azure Active Directory 模块进行配置。These settings are configured by the Azure Active Directory Module for Windows PowerShell. 请从 Azure AD Connect 单独下载并安装此模块。Download and install it separately from Azure AD Connect. 2016 年 3 月版(内部版本 9031.1)中引入了本主题所述的 cmdlet。The cmdlets documented in this topic were introduced in the 2016 March release (build 9031.1). 如果没有本主题中所述的 cmdlet,或者它们不生成相同的结果,请确保运行最新的版本。If you do not have the cmdlets documented in this topic or they do not produce the same result, then make sure you run the latest version.

若要查看 Azure AD 目录中的配置,请运行 Get-MsolDirSyncFeaturesTo see the configuration in your Azure AD directory, run Get-MsolDirSyncFeatures.
Get-MsolDirSyncFeatures 结果

其中的许多设置只能由 Azure AD Connect 更改。Many of these settings can only be changed by Azure AD Connect.

Set-MsolDirSyncFeature可以配置以下设置:The following settings can be configured by Set-MsolDirSyncFeature:

DirSyncFeatureDirSyncFeature 注释Comment
EnableSoftMatchOnUpnEnableSoftMatchOnUpn 除了允许对象加入主 SMTP 地址,还允许对象加入 userPrincipalName。Allows objects to join on userPrincipalName in addition to primary SMTP address.
SynchronizeUpnForManagedUsersSynchronizeUpnForManagedUsers 允许同步引擎更新托管/许可(非联合)用户的 userPrincipalName 属性。Allows the sync engine to update the userPrincipalName attribute for managed/licensed (non-federated) users.

启用某个功能后,无法再次将其禁用。After you have enabled a feature, it cannot be disabled again.

Note

从 2016 年 8 月 24 日起,为新的 Azure AD 目录默认启用重复属性复原功能。From August 24, 2016 the feature Duplicate attribute resiliency is enabled by default for new Azure AD directories. 还会针对此日期之前创建的目录推出并启用此功能。This feature will also be rolled out and enabled on directories created before this date. 当目录即将启用此功能时,会收到电子邮件通知。You will receive an email notification when your directory is about to get this feature enabled.

以下设置由 Azure AD Connect 配置,无法通过 Set-MsolDirSyncFeature修改:The following settings are configured by Azure AD Connect and cannot be modified by Set-MsolDirSyncFeature:

DirSyncFeatureDirSyncFeature 注释Comment
DirectoryExtensionsDirectoryExtensions Azure AD Connect 同步:目录扩展Azure AD Connect sync: Directory extensions
DuplicateProxyAddressResiliencyDuplicateProxyAddressResiliency
DuplicateUPNResiliencyDuplicateUPNResiliency
如果某个属性是另一个对象的副本而不会在导出期间导致整个对象失败,则允许隔离该属性。Allows an attribute to be quarantined when it is a duplicate of another object rather than failing the entire object during export.
密码哈希同步Password Hash Sync 使用 Azure AD Connect 同步实现密码哈希同步Implementing password hash synchronization with Azure AD Connect sync

重复属性复原 Duplicate attribute resiliency

将重复属性“隔离”并分配临时值,而不是使预配包含重复 UPN/proxyAddress 的对象失败。Instead of failing to provision objects with duplicate UPNs / proxyAddresses, the duplicated attribute is “quarantined” and a temporary value is assigned. 解决冲突后,临时 UPN 会自动更改为适当的值。When the conflict is resolved, the temporary UPN is changed to the proper value automatically. 有关详细信息,请参阅标识同步和重复属性复原For more details, see Identity synchronization and duplicate attribute resiliency.

UserPrincipalName 软匹配UserPrincipalName soft match

启用此功能后,除了始终启用的主 SMTP 地址外,还将为 UPN 启用软匹配。When this feature is enabled, soft-match is enabled for UPN in addition to the primary SMTP address, which is always enabled. 软匹配功能用于将 Azure AD 中的现有云用户与本地用户进行匹配。Soft-match is used to match existing cloud users in Azure AD with on-premises users.

如果需要将本地 AD 帐户与云中创建的现有帐户进行匹配,但未使用 Exchange Online,则此功能非常有用。If you need to match on-premises AD accounts with existing accounts created in the cloud and you are not using Exchange Online, then this feature is useful. 在此情况下,通常没有必要在云中设置 SMTP 属性。In this scenario, you generally don’t have a reason to set the SMTP attribute in the cloud.

在新建的 Azure AD 目录中,默认已打开此功能。This feature is on by default for newly created Azure AD directories. 可以运行以下命令查看是否已启用此功能:You can see if this feature is enabled for you by running:

Get-MsolDirSyncFeatures -Feature EnableSoftMatchOnUpn

如果没有为 Azure AD 目录启用此功能,可以运行以下命令来启用它:If this feature is not enabled for your Azure AD directory, then you can enable it by running:

Set-MsolDirSyncFeature -Feature EnableSoftMatchOnUpn -Enable $true

同步 userPrincipalName 更新Synchronize userPrincipalName updates

在过去,除非以下两个条件都成立,否则会阻止在本地使用同步服务对 UserPrincipalName 属性进行更新:Historically, updates to the UserPrincipalName attribute using the sync service from on-premises has been blocked, unless both of these conditions are true:

  • 托管用户(非联合)。The user is managed (non-federated).
  • 没有为用户分配许可证。The user has not been assigned a license.

有关详细信息,请参阅 Office 365、Azure 或 Intune 中的用户名与本地 UPN 或备用登录 ID 不匹配For more details, see User names in Office 365, Azure, or Intune don't match the on-premises UPN or alternate login ID.

如果 userPrincipalName 在本地发生更改并且你使用密码哈希同步,则启用此功能后,同步引擎可将其更新。如果使用联合身份验证,此功能不受支持。Enabling this feature allows the sync engine to update the userPrincipalName when it is changed on-premises and you use password hash sync. If you use federation, this feature is not supported.

在新建的 Azure AD 目录中,默认已打开此功能。This feature is on by default for newly created Azure AD directories. 可以运行以下命令查看是否已启用此功能:You can see if this feature is enabled for you by running:

Get-MsolDirSyncFeatures -Feature SynchronizeUpnForManagedUsers

如果没有为 Azure AD 目录启用此功能,可以运行以下命令来启用它:If this feature is not enabled for your Azure AD directory, then you can enable it by running:

Set-MsolDirSyncFeature -Feature SynchronizeUpnForManagedUsers -Enable $true

启用此功能后,现有的 userPrincipalName 值将保持不变。After enabling this feature, existing userPrincipalName values will remain as-is. 下一次在本地更改 userPrincipalName 属性时,对用户进行正常的增量同步会更新 UPN。On next change of the userPrincipalName attribute on-premises, the normal delta sync on users will update the UPN.

另请参阅See also