MicrosoftMicrosoftHi Irina_Nechaeva ,
I was working in a PoC of SAP IDM migration to Microsoft Entra ID which I noticed -
One of the crucial features in SAP IDM is with information from HCM system, by applying the requisite business logic to provision identities into Active Directory. Basically end-to-end User lifecycle Management with Active Directory system, as most customers refrain from manual intervention in AD.
But it seems Microsoft Entra ID CANNOT writeback users into on-prem AD if both are in the same DC, which will mostly be the case. Kindly check here -
https://learn.microsoft.com/en-us/answers/questions/2029426/possibibility-to-sync-azure-entra-id-to-on-prem-dc
If this is true, then what will be the alternate approach to managing the on-prem AD user lifecycle?
-RP
MicrosoftHi, Microsoft Entra can be used to update users (and also populate groups) in an on-premises AD, based on properties of a working coming from an HCM system such as SuccessFactors, as well update the users in other directories, databases and applications. Configuring a basic flow from SuccessFactors into a single AD domain is shown in https://learn.microsoft.com/entra/identity/saas-apps/sap-successfactors-inbound-provisioning-tutorial and the Cloud HR provisioning guide at https://learn.microsoft.com/entra/identity/app-provisioning/plan-cloud-hr-provision illustrates more supported topologies for AD as a provisioning target driven by a HCM system. Additional tasks, such as deleting AD users a number of days after termination, are listed in https://learn.microsoft.com/entra/id-governance/lifecycle-workflow-on-premises and setting up group membership for AD-group-based apps can be done in Microsoft Entra with group writeback to AD, as shown at https://learn.microsoft.com/entra/identity/hybrid/cloud-sync/govern-on-premises-groups There is also a step-by-step guide to the process of configuring Microsoft Entra with SAP HR sources and target apps, including updating AD for those SAP apps which rely upon AD, at https://learn.microsoft.com/entra/identity/app-provisioning/plan-sap-user-source-and-target
The articles shared sound like a detour, but they meet the requirements. I've a lot of questions now with these articles, but I'll pause and start configuring before I ask them. I'm sure these will be answered in the configuration itself.
