MicrosoftMicrosoft
MicrosoftHi, Microsoft Entra can be used to update users (and also populate groups) in an on-premises AD, based on properties of a working coming from an HCM system such as SuccessFactors, as well update the users in other directories, databases and applications. Configuring a basic flow from SuccessFactors into a single AD domain is shown in https://learn.microsoft.com/entra/identity/saas-apps/sap-successfactors-inbound-provisioning-tutorial and the Cloud HR provisioning guide at https://learn.microsoft.com/entra/identity/app-provisioning/plan-cloud-hr-provision illustrates more supported topologies for AD as a provisioning target driven by a HCM system. Additional tasks, such as deleting AD users a number of days after termination, are listed in https://learn.microsoft.com/entra/id-governance/lifecycle-workflow-on-premises and setting up group membership for AD-group-based apps can be done in Microsoft Entra with group writeback to AD, as shown at https://learn.microsoft.com/entra/identity/hybrid/cloud-sync/govern-on-premises-groups There is also a step-by-step guide to the process of configuring Microsoft Entra with SAP HR sources and target apps, including updating AD for those SAP apps which rely upon AD, at https://learn.microsoft.com/entra/identity/app-provisioning/plan-sap-user-source-and-target
The articles shared sound like a detour, but they meet the requirements. I've a lot of questions now with these articles, but I'll pause and start configuring before I ask them. I'm sure these will be answered in the configuration itself.
