What type of entity should be specified for syncing with Azure AD Connect for best practices?

• A. An ordinary user account
• B. A service account only
• C. A Global Administrator account
• D. Any local account

Answer: (C)

Using a Global Administrator account for syncing with Azure AD Connect is considered best practice as it ensures that the account has the necessary permissions to perform all the required tasks during synchronization. This account has access to all Azure AD features and can manage the configuration of Azure AD Connect itself, including managing users, groups, and other directory objects.

Choosing a Global Administrator account helps avoid potential permission issues that might arise with other account types, ensuring a smooth setup and ongoing operations for Azure AD Connect. As a primary administrative account, it also grants the necessary access that might be required for future changes or troubleshooting.

In contrast, an ordinary user account may lack the necessary permissions for effective synchronization. Using only a service account could lead to complications if that account does not have sufficient privileges or if it becomes inactive. Lastly, utilizing any local account presents additional risks due to the potential lack of roles and permissions required for seamless integration with Azure AD. Thus, the choice of a Global Administrator account provides both the security and functionality needed for optimal operation of Azure AD Connect.