Blog Post

Microsoft Entra Blog
2 MIN READ

Use cloud groups in on-premises Active Directory with group writeback

KristinaHotz's avatar
KristinaHotz
Icon for Microsoft rankMicrosoft
Jul 06, 2022

I'm thrilled to announce major enhancements to group writeback are in public preview! Use Azure AD Connect to write cloud groups, including security groups, back to your on-premises Active Directory. With this preview, you can manage access to on-premises resources with groups that are managed in the cloud.

  

Today, you can write M365 groups back to their on-premises Active Directory as universal distribution groups. With this public preview, we’ve expanded what groups can be written back, added the ability to manage groups for writeback in MS Graph and the Azure Admin Portal, and added a feature in Azure AD Connect to make it easier to find your groups on-prem.

 

M365 group enhancements 

  • You'll now be able to write your M365 groups back to on-premises Active Directory as either a universal Distribution Group, Security Group, or Mail-Enabled Security Group using PowerShell, MS Graph, or the Azure Admin Portal. 
  • You can set a tenant-wide setting to automatically write back newly created M365 groups using MS Graph. 

 

New group writeback features 

  • You can now also configure writing Azure AD Security Groups back to on-premises Active Directory as a universal Security Group using PowerShell, MS Graph, or the Microsoft Entra admin center. 
  • When configuring group writeback in Azure AD Connect, you have the option to swap the common name of the on-prem distinguished name to be the cloud group’s display name, making it easier to identify what groups are being written back from Azure AD.
  • You can manage what groups you’d like to write back to Active Directory using MS Graph Explorer and the Microsoft Entra admin center. 

 

 

 

 

Learn more about Microsoft identity: 

 

Updated Jun 28, 2022
Version 1.0
identity and access management
KristinaHotz's avatar
Icon for Microsoft rankMicrosoft
Joined July 01, 2020
View Profile
Microsoft Entra Blog
Stay informed on how to secure access for employees, customers, and non-human identities, from anywhere, to multicloud and on-premises resources, with comprehensive identity and network access solutions powered by AI.

23 Comments

  • atguilmette's avatar
    atguilmette
    Copper Contributor
    Dec 28, 2023

    Yes, I was leaning towards it being supported (forgot to mention that link, so thank-you for adding it), but it looked like it was more in a "transition to full cloud sync" as opposed to a long-term SxS deployment. As far as deployment goes, I wasn't sure what the plan was for doing both AADC-based group writeback (which needs to be flipped on) and AAD cloud sync writeback. Perhaps a scoping filter on the AAD Connect server rule to ensure only one sync agent is touching the writeback objects?

     

    I'm going to roll it in a lab to see what happens and will hopefully remember to report back here. 🙂

     

  • juliansperling's avatar
    juliansperling
    Brass Contributor
    Dec 28, 2023

    atguilmette Judging by the Information block on https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-group-writeback-v2 I would say yes - they explicitly list it as a supported scenario, but you would have to make very sure that Entra ID Connect Cloud Sync does not touch any objects managed by Connect Sync.

  • atguilmette's avatar
    atguilmette
    Copper Contributor
    Dec 28, 2023

    Is it possible to run Azure AD Connect with writeback AND Azure AD Connect Cloud sync at the same time?  I'm in a scenario where I have complex rules that aren't supported in cloud sync, but would like to be able to utilize security-group writeback to solve a specific business problem as part of a migration.