Tohle jsem netušil, a přitom je to prima:
Populating the “adminDescription” attribute with the value “User_NoO365Sync” or “Group_NoO365Sync” (depending on the object type) will allow you to easily filter these objects.
Office 365 – The (Previously) Undocumented AAD Connect Filter
https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnectsync-understanding-default-configuration/