Why are disabled accounts synchronized to AAD

Question

I used the Azure AD Connector to set up WAAD Synchronization.
I used the defaults.  Everything seemed to work fine.
After synchronization I see that all of my AD disabled accounts exist in WAAD.
Based on the default rules setup particularly the "In from AD - User AccountEnabled" rule I wouldn't have expected this.  Can someone explain to me why this is?  And how to remove disabled user accounts from WAAD synchronization.
Thanks! 

Answer 1

"In from AD - User AccountEnabled" is a rule that only applies to accounts with the ACCOUNTDISABLE flag set to off, it does nothing to decide whether to sync the object. If you want to exclude disabled user accounts, you need to create a new
rule (or edit some existing one) following the instructions here:
http://msdn.microsoft.com/en-us/library/azure/dn801051.aspx#BKMK_ConfigureAttributeBasedFiltering
For example, this should filter out all the Disabled accounts:
Log on to the computer that is running AADSync by using an account that is a member of the ADSyncAdmins security group.
Open Synchronization Rules Editor by finding it in the Start Menu.
Make sure Inbound is selected and click Add New Rule.
Give the rule a descriptive name, such as "Filter
out disabled accounts", select the correct forest under Connected system, User as the Connected system object type, and Person as the Metaverse object type. In Link Type select Join and
in precedence type a value currently not used by another Synchronization Rule, e.g. 50. Click Next.
In Scoping filter click Add Group, click Add Clause and in attribute select
userAccountControl. Make sure the Operator is set to ISBITSET
and type in the value 2 in the Value box. Click Next.
Leave the Join rules empty and click Next.
Click Add Transformation, select the FlowType to Constant, select the Target Attribute cloudFiltered and in the Source text box, type in True. Click Add to save the rule.
Perform a full sync: on the Connectors tab, right-click SourceAD, click Run, click Full Synchronization, and then click OK.
Here's how the rule looks in PowerShell:
PS C:\> Get-ADSyncRule -Identifier '860a523a-bcb0-4aef-b58e-7d17cb6fbd35'
Identifier : 860a523a-bcb0-4aef-b58e-7d17cb6fbd35
Name : Filter out disabled accounts
Version : 1
Description :
ImmutableTag :
Connector : df4655c7-dcf6-4010-8b39-68306199b0e8
Direction : Inbound
SourceObjectType : user
TargetObjectType : person
Precedence : 50
PrecedenceAfter : 00000000-0000-0000-0000-000000000000
PrecedenceBefore : 00000000-0000-0000-0000-000000000000
LinkType : Join
JoinFilter : {}
ScopeFilter : {Microsoft.IdentityManagement.PowerShell.ObjectModel.ScopeConditionGroup}
AttributeFlowMappings : {Destination:cloudFiltered FlowType:Constant Expression: ValueMergeType: Update}
SoftDeleteExpiryInterval : 00:00:00
SourceNamespaceId : df4655c7-dcf6-4010-8b39-68306199b0e8
TargetNamespaceId : cc31d470-9786-447f-8594-40abe13f9f78
PS C:\> (Get-ADSyncRule -Identifier '860a523a-bcb0-4aef-b58e-7d17cb6fbd35').scopefilter.ScopeConditionList
Attribute ComparisonValue ComparisonOperator
userAccountControl 2 ISBITSET
PS C:\> (Get-ADSyncRule -Identifier '860a523a-bcb0-4aef-b58e-7d17cb6fbd35').AttributeFlowMappings
Source : {True}
Destination : cloudFiltered
FlowType : Constant
ExecuteOnce : False
Expression :
ValueMergeType : Update
MappingSourceAsString : True