Microsoft Entra ID

Import ADSyncTools module

7 August 2026Updated+15 / −10 lines

In brief

The documentation replaces a direct Microsoft Graph beta PATCH request with Microsoft Graph PowerShell cmdlets, including the `OnPremDirectorySynchronization.ReadWrite.All` scope. It now sets `AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled` to `$true` temporarily and explains that `$false` re-enables hard match protection.

What Entra admins need to know

Administrators following this procedure should use the revised commands and account for the required Graph permission and temporary protection change.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Alternatively, to clear onPremisesObjectIdentifier with ADSyncTools version 2.5.0 or later, run the following commands:

# Import ADSyncTools module
Import-Module ADSyncTools

# Provide the user's identity.
$userId = "<userId>"

If you can't remediate affected objects before enforcement, enable the tenant-level feature flag `allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled`. This flag is disabled by default. Leave the flag disabled unless you need a temporary bypass while you complete remediation.

```powershell
$baseUri =# Connect to Microsoft Graph
Connect-MgGraph -Scopes "https://graph.microsoft.com/betaOnPremDirectorySynchronization.ReadWrite.All"

$onPremSync# Temporary Disable allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled
$DirectorySync = Get-MgDirectoryOnPremiseSynchronization
$uri = "$baseUri/directory/onPremisesSynchronization/$($onPremSync.Id)"
$params = @{
    features = @{
        allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled$DirectorySync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled = $true }
}
Invoke-MgGraphRequest -Method PATCH -Uri $uri -Body $params
(Get-MgDirectoryOnPremiseSynchronization).# To re-enable hard match protection, set it $false
Update-MgDirectoryOnPremiseSynchronization -Features $DirectorySync.Features | fl-OnPremisesDirectorySynchronizationId $DirectorySync.Id

# Get AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled value
$DirectorySync = Get-MgDirectoryOnPremiseSynchronization
$DirectorySync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled

@@ -179,6 +179,9 @@ This PATCH request requires the `User-OnPremisesSyncBehavior.ReadWrite.All` Micr Alternatively, to clear `onPremisesObjectIdentifier` with ADSyncTools version 2.5.0 or later, run the following commands:  ```powershell+# Import ADSyncTools module+Import-Module ADSyncTools+ # Provide the user's identity. $userId = "<userId>" @@ -199,16 +202,18 @@ After you clear the value, rerun synchronization. If you can't remediate affected objects before enforcement, enable the tenant-level feature flag `allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled`. This flag is disabled by default. Leave the flag disabled unless you need a temporary bypass while you complete remediation.  ```powershell-$baseUri = "https://graph.microsoft.com/beta"-$onPremSync = Get-MgDirectoryOnPremiseSynchronization-$uri = "$baseUri/directory/onPremisesSynchronization/$($onPremSync.Id)"-$params = @{-    features = @{-        allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled = $true-    }-}-Invoke-MgGraphRequest -Method PATCH -Uri $uri -Body $params-(Get-MgDirectoryOnPremiseSynchronization).Features | fl+# Connect to Microsoft Graph+Connect-MgGraph -Scopes "OnPremDirectorySynchronization.ReadWrite.All"++# Temporary Disable allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled+$DirectorySync = Get-MgDirectoryOnPremiseSynchronization+$DirectorySync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled = $true # To re-enable hard match protection, set it $false+Update-MgDirectoryOnPremiseSynchronization -Features $DirectorySync.Features -OnPremisesDirectorySynchronizationId $DirectorySync.Id++# Get AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled value+$DirectorySync = Get-MgDirectoryOnPremiseSynchronization+$DirectorySync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled+ ```  > [!WARNING]