This is becoming more and more painful as time goes on,
It would be almost a godsend to restrict azure syncing to a specific security group, especially with large clients and even franchisees where they use office 365 for email and identity but we are not allowed to setup sso as it is not group...