User accounts for Office 365 are stored in Azure Active Directory. The accounts will either be cloud identities, or synced identities. Cloud identities are accounts that exist only in Office 365/Azure AD, whereas synced identities are those that exist in an on-premises Active Directory and are being synchronized to Azure AD using a directory sync tool such as Azure AD Connect.

If you want to retrieve a list of synced and non-synced identities you can do so using the AzureAD PowerShell module. After connecting to Azure AD, use the Get-AzureADUser cmdlet to retrieve a list of users. You can group the users by the DirSyncEnabled property to get a count of synced and non-synced accounts.

PS C:\>Connect-AzureAD

PS C:\> Get-AzureADUser | Group-Object -Property:DirSyncEnabled

Count Name                      Group
----- ----                      -----
   98 True                      {class User {...
    2                           {class User {...

The first time I saw this I expected to see values of True and False, but instead it seems we get values of True and null. So, to retrieve a list of synced users, the command would be as follows:

PS C:\> Get-AzureADUser | Where {$_.DirSyncEnabled -eq $true}

Here’s an example where I’ve retrieved the DirSyncEnabled and LastDirSyncTime properties as well.

PS C:\> Get-AzureADUser | Where {$_.DirSyncEnabled -eq $true} | Select -Property DisplayName,UserPrincipalName
,DirSyncEnabled,LastDirSyncTime | ft -auto

DisplayName    UserPrincipalName                    DirSyncEnabled LastDirSyncTime
-----------    -----------------                    -------------- ---------------
Aaron Gardiner           True 10/19/2017 1:56:03 PM
Adam Wally               True 10/19/2017 1:56:03 PM
Aisha Bhari              True 10/19/2017 1:50:52 PM
Alan Reid                True 10/19/2017 1:56:03 PM
Alannah Shaw             True 10/19/2017 1:56:03 PM
Aldith Walker            True 10/19/2017 1:52:08 PM
Alex Heyne               True 10/19/2017 1:56:03 PM
Alice Mullins            True 10/19/2017 1:53:24 PM
Alison Pugh              True 10/19/2017 1:47:08 PM
Almaz Duggan             True 10/19/2017 1:56:02 PM

To retrieve a list of non-synced, or cloud-only identities, the command would be as follows:

PS C:\> Get-AzureADUser | Where {$_.DirSyncEnabled -eq $null}

ObjectId                      DisplayName                   UserPrincipalName             UserType
--------                      -----------                   -----------------             --------
8db8b044-b825-4456-b6f7-39... Paul Cunningham               admin@exchangeserverpro.on...
00a77560-657b-44c3-9f38-08... Cloudy Room                   CloudyRoom@exchangeserverp... Member

About the Author

Paul Cunningham

Paul is a former Microsoft MVP for Office Apps and Services. He works as a consultant, writer, and trainer specializing in Office 365 and Exchange Server. Paul no longer writes for


  1. Natalie Frith

    Comments for this blog post are now closed; please contact for any additional questions and comments, thank you.

  2. upwan

    can you please help me to get list of all synced OU in AAdconnect, how to list them using powershell command or any other way?

  3. Nathan P

    Isn’t this restricting the number of results to 100 by default??

    1. Michael Smith

      yup would need “get-azureaduser -all $true” to get everyone

      1. shaun

        what would the correct syntax for that look like ??
        (I keep getting error)

Comments are closed.