Microsoft Entra ID

Connect to Microsoft Graph.

9 August 2026Updated+21 / −8 lines

In brief

The documentation now uses clearer commands to enable and verify `AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled`, and explicitly shows how to set it back to `$false` after remediation to re-enable hard match protection.

What Entra admins need to know

Administrators following this procedure should use the revised commands, verify the flag’s value, and restore it to `$false` when remediation is complete.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

If you can't remediate affected objects before enforcement, enable the tenant-level feature flag allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled. This flag is disabled by default. Leave the flag disabled unless you need a temporary bypass while you complete remediation.

# Connect to Microsoft GraphGraph.
Connect-MgGraph -Scopes "OnPremDirectorySynchronization.ReadWrite.All"

# Temporary Disable allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled
$DirectorySyncEnable the temporary bypass.
$OnPremSync = Get-MgDirectoryOnPremiseSynchronization
$DirectorySync.$OnPremSync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled = $true

Update-MgDirectoryOnPremiseSynchronization `
    -OnPremisesDirectorySynchronizationId $OnPremSync.Id `
    -Features $OnPremSync.Features

# Verify the current value.
$OnPremSync = Get-MgDirectoryOnPremiseSynchronization
$OnPremSync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled

To re-enable hard match ~~protection,~~protection after remediation, set itthe flag back to $false:

$OnPremSync = Get-MgDirectoryOnPremiseSynchronization
$OnPremSync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled = $false

Update-MgDirectoryOnPremiseSynchronization `
    -OnPremisesDirectorySynchronizationId $OnPremSync.Id `
    -Features $DirectorySync.$OnPremSync.Features -OnPremisesDirectorySynchronizationId $DirectorySync.Id

# Get AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled value
$DirectorySync = Get-MgDirectoryOnPremiseSynchronization
$DirectorySync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled

@@ -202,18 +202,31 @@ After you clear the value, rerun synchronization. If you can't remediate affected objects before enforcement, enable the tenant-level feature flag `allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled`. This flag is disabled by default. Leave the flag disabled unless you need a temporary bypass while you complete remediation.  ```powershell-# Connect to Microsoft Graph+# Connect to Microsoft Graph. Connect-MgGraph -Scopes "OnPremDirectorySynchronization.ReadWrite.All" -# Temporary Disable allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled-$DirectorySync = Get-MgDirectoryOnPremiseSynchronization-$DirectorySync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled = $true # To re-enable hard match protection, set it $false-Update-MgDirectoryOnPremiseSynchronization -Features $DirectorySync.Features -OnPremisesDirectorySynchronizationId $DirectorySync.Id+# Enable the temporary bypass.+$OnPremSync = Get-MgDirectoryOnPremiseSynchronization+$OnPremSync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled = $true++Update-MgDirectoryOnPremiseSynchronization `+    -OnPremisesDirectorySynchronizationId $OnPremSync.Id `+    -Features $OnPremSync.Features++# Verify the current value.+$OnPremSync = Get-MgDirectoryOnPremiseSynchronization+$OnPremSync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled+```++To re-enable hard match protection after remediation, set the flag back to `$false`: -# Get AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled value-$DirectorySync = Get-MgDirectoryOnPremiseSynchronization-$DirectorySync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled+```powershell+$OnPremSync = Get-MgDirectoryOnPremiseSynchronization+$OnPremSync.Features.AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled = $false +Update-MgDirectoryOnPremiseSynchronization `+    -OnPremisesDirectorySynchronizationId $OnPremSync.Id `+    -Features $OnPremSync.Features ```  > [!WARNING]