Learn

Group Provisioning to Active Directory

Group provisioning to AD is a Cloud Sync capability that writes security groups from Entra ID back to on-premises Active Directory. This is distinct from Connect Sync’s group writeback feature, and it is available exclusively in Cloud Sync.

This capability supports scenarios where Entra ID is the source of authority for group management, but on-premises applications still need AD security groups for access control (e.g., Kerberos-based apps).

What It Does

Cloud Sync can provision cloud-originated security groups to AD. When a security group is created or updated in Entra ID, Cloud Sync creates a corresponding group in a target OU in Active Directory and maintains its membership.

The key distinction is source of authority (SOA):

  • Groups whose SOA is in the cloud are eligible for provisioning to AD.
  • Groups whose SOA is on-premises (synced from AD to Entra ID) are not provisioned back - they are already managed on-premises.
  • Only synced user members (users with an onPremisesObjectIdentifier) are included as group members in AD. Cloud-only users are skipped because they have no corresponding AD object.

Configuration

Prerequisites

  • Cloud Sync provisioning agent version 1.1.1370.0 or later.
  • A target OU in AD where groups will be created.
  • Users who will be group members must already be synced between AD and Entra ID (either via Cloud Sync or Connect Sync) so they have the onPremisesObjectIdentifier attribute set.

Setup Steps

  1. In the Entra admin center, go to Cloud sync > New configuration.
  2. Select Microsoft Entra ID to AD sync (not AD to Entra ID).
  3. Choose your domain and select Create.
  4. Under Scoping filters, set Groups scope to Selected security groups. This is the recommended default to avoid performance issues.
  5. Configure the Target container - the OU where groups will be created. Three approaches:
    • Constant mapping: All groups go to the same OU (simplest).
    • Expression-based: Use a Switch() expression on displayName to route groups to different OUs.
    • Extension attribute: Use a custom extension attribute (GroupDN) to preserve the original OU path when re-provisioning converted SOA groups.
  6. Select Review and enable > Enable configuration.

Testing

Use on-demand provisioning to test before enabling the full configuration:

  1. Select Provision on demand.
  2. Enter the group name in Selected group.
  3. Select up to five member users to test.
  4. Select Provision and verify the group appears in AD.

Note: On-demand provisioning does not automatically provision all members. You select specific members to test, with a limit of five per request.

Source of Authority Behavior

Understanding SOA behavior is critical for group provisioning:

Group SOAUser Member SOAProvisioning Behavior
CloudOn-premisesGroup provisioned with all member references
CloudCloudGroup provisioned, but no member references (cloud users have no AD object)
CloudMixedGroup provisioned, only on-premises members included
CloudNone (empty group)Group provisioned as empty
On-premisesAnyGroup not provisioned (already managed on-premises)

SOA Conversion

When you convert a group’s SOA from on-premises to cloud, it becomes eligible for group provisioning to AD. Cloud Sync matches it to the existing AD group and updates it.

If you roll back the SOA conversion (back to on-premises), Cloud Sync stops syncing the group but does not delete it from AD. On-premises control resumes on the next sync cycle.

Multi-Forest Considerations

Group provisioning works in multi-forest environments, but with constraints:

  • Groups provisioned to AD can only contain users whose onPremisesObjectIdentifier matches an objectGUID in the target AD forest.
  • If a group contains users from multiple forests, only users that exist in each specific forest are provisioned as members when the group is written to that forest. Users from other forests are skipped.
  • Each forest needs its own Cloud Sync agent and Entra ID to AD configuration.

Nested Groups

Cloud Sync handles nested group membership with specific rules:

Parent Group SOAMember Group SOABehavior
Entra ID security groupEntra ID security groupParent provisioned with member group references
Entra ID security groupOn-premises (synced)Parent provisioned, synced member groups not included
Entra ID security groupOn-premises with SOA converted to cloudParent provisioned with member group references

Limitations and Gotchas

  • Security groups only. Microsoft 365 groups and distribution groups are not supported for provisioning to AD.
  • 50,000 member limit. Groups with more than 50,000 members are not supported.
  • Cloud-only users skipped. Members without onPremisesObjectIdentifier are silently excluded from the AD group.
  • Scoping recommendation. Always use Selected security groups scoping to avoid performance issues with large numbers of groups.
  • On-demand provisioning member limit. Testing is limited to five members per on-demand request.
  • No user provisioning to AD. Cloud Sync can provision groups to AD, but not individual users. User provisioning to AD is not currently supported.
  • AdminDescription and CN updates. When Cloud Sync provisions a group, it may update the adminDescription and cn attributes in AD. Be aware of this if you have processes that depend on these attributes.

Migrating from Connect Sync Group Writeback

If you are currently using Connect Sync’s group writeback V2 feature, you can migrate to Cloud Sync’s group provisioning. The process involves:

  1. Disabling group writeback in Connect Sync.
  2. Configuring group provisioning in Cloud Sync.
  3. Converting the SOA of the affected groups to cloud.

See the Microsoft migration guide for detailed steps.