Entra.News Dailydaily.entra.news
Aboutmerill.net
Microsoft Entra ID

Scenario - Using directory extensions with group provisioning to Active Directory

27 June 2026Updated+24 / −22 lines

In brief

This topic describes how to extend the schema of a group with a new attribute. Then use the new attribute to filter groups for provisioning to Active Directory.

Documentation change

For a better experience executing Microsoft Graph PowerShell SDK cmdlets, use Visual Studio Code with ms-vscode.powershell extension in ISE Mode.

Create two groups in Microsoft Entra ID

To begin, create two groups in Microsoft Entra ID. One group is Sales and the Other is Marketing.

To create two groups, follow these steps.

  1. Sign in to the Microsoft Entra admin center as at least a Hybrid Identity Administrator.
  2. Browse to Entra ID > Groups > All groups.
  1. At the top, click New group.
  1. At the top, select New group.
  1. Make sure the Group type is set to security.
  2. For the Group Name enter Sales
  3. For Membership type keep it at assigned.
  1. Click Create.
  1. Select Create.
  1. Repeat this process using Marketing as the Group Name.

Add users to the newly created groups

  1. Sign in to the Microsoft Entra admin center as at least a Hybrid Identity Administrator.
  2. Browse to Entra ID > Groups > All groups.
  3. At the top, in the search box, enter Sales.
  1. Click on the new Sales group.
  2. On the left, click Members
  3. At the top, click Add members.
  1. Select the new Sales group.
  2. On the left, select Members.
  3. At the top, select Add members.
  1. At the top, in the search box, enter Britta Simon.
  1. Put a check next to Britta Simon and Anna Ringdahl and click Select
  1. Put a check next to Britta Simon and Anna Ringdahl and select Select.
  1. It should successfully add her to the group.
  1. On the far left, click All groups and repeat this process using the Marketing group and adding Lola Jacobson and John Smith to that group.
  1. On the far left, select All groups and repeat this process using the Marketing group and adding Lola Jacobson and John Smith to that group.

Create our CloudSyncCustomExtensionApp application and service principal

  1. Get the Tenant ID:

:::image type="content" source="media/how-to-configure-entra-to-active-directory/entra-to-ad-1.png" alt-text="Screenshot of configuration selection." lightbox="media/how-to-configure-entra-to-active-directory/entra-to-ad-1.png":::

  1. On the configuration screen, select your domain and whether to enable password hash sync. Click Create.
  1. On the configuration screen, select your domain and whether to enable password hash sync. Select Create.

:::image type="content" source="media/how-to-configure/new-ux-configure-2.png" alt-text="Screenshot of a new configuration." lightbox="media/how-to-configure/new-ux-configure-2.png":::

  1. The Get started screen opens. From here, you can continue configuring cloud sync
  1. On the left, click Scoping filters select Group scope - All groups
  1. On the left, select Scoping filters, then select Group scope > All groups.
  1. Click Edit attribute mapping and change the Target Container to OU=Groups,DC=Contoso,DC=com. Click Save.
  1. Select Edit attribute mapping and change the Target Container to OU=Groups,DC=Contoso,DC=com. Select Save.
  1. Click Add Attribute scoping filter
  1. Select Add Attribute scoping filter.
  1. Type a name for the scoping filter: Filter groups with Writeback Enabled

:::image type="content" source="media/tutorial-directory-extension-group-provision/directory-extension-group-provision-4.png" alt-text="Screenshot of available attributes." lightbox="media/tutorial-directory-extension-group-provision/directory-extension-group-provision-4.png":::

  1. Under Operator select IS TRUE
  2. Click Save. And click Save.
  1. Under Operator select IS TRUE.
  2. Select Save, and then select Save.
  1. Leave the configuration disabled and come back to it.

Add new extension property to one of our groups

You need to make sure that you have consented to Group.ReadWrite.All. You can do this by selecting Modify permissions.

  1. Navigate to Microsoft Graph Explorer
  1. Sign-in using your tenant administrator account. This may need to be a Hybrid Identity Administrator account. A Hybrid Identity Administrator account was used in creating this scenario. A Hybrid Identity Administrator account may be sufficient.
  1. Sign in using your tenant administrator account. A Hybrid Identity Administrator account was used to create this scenario and might be sufficient.
  1. At the top, change the GET to PATCH
  2. In the address box enter: https://graph.microsoft.com/v1.0/groups/<Group Id>
  3. In the Request body enter:

{

extension_<guid>_WritebackEnabled: true

 "extension_<guid>_WritebackEnabled": true

}
  1. Click Run query
  1. Select Run query.

:::image type="content" source="media/tutorial-directory-extension-group-provision/directory-extension-group-provision-1.png" alt-text="Screenshot of running the graph query." lightbox="media/tutorial-directory-extension-group-provision/directory-extension-group-provision-1.png":::

  1. If done correctly, you see [].
  2. Now at the top, change PATCH to GET and look at the properties of the marketing group.
  1. Click Run query. You should see the newly created attribute.
  1. Select Run query. You should see the newly created attribute.

:::image type="content" source="media/tutorial-directory-extension-group-provision/directory-extension-group-provision-2.png" alt-text="Screenshot of group properties." lightbox="media/tutorial-directory-extension-group-provision/directory-extension-group-provision-2.png":::

  1. On the left, select Provision on demand.
  2. Enter Marketing in the Selected group box
  3. From the Selected users section, select some users to test. Select Lola Jacobson and John Smith.
  1. Click Provision. It should successfully provision.
  1. Select Provision. It should successfully provision.

:::image type="content" source="media/tutorial-directory-extension-group-provision/directory-extension-group-provision-5.png" alt-text="Screenshot of successful provision." lightbox="media/tutorial-directory-extension-group-provision/directory-extension-group-provision-5.png"::: 8. Now try with the Sales group and add Britta Simon and Anna Ringdahl. This shouldn't provision. :::image type="content" source="media/tutorial-directory-extension-group-provision/directory-extension-group-provision-6.png" alt-text="Screenshot of provisioning being blocked." lightbox="media/tutorial-directory-extension-group-provision/directory-extension-group-provision-6.png":::