Microsoft Entra ID

Group Source Of Authority Guidance

28 August 2026Doc update+2 / −2 lines

In brief

The guidance now links to the Microsoft Entra ID-to-Active Directory provisioning overview and its nested group membership behavior section.

What Entra admins need to know

Administrators can use the updated links for current information about group synchronization and nested group membership.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Convert the Source of Authority (SOA) when ready.
Use custom expressions to ensure Cloud Sync provisions groups back to AD DS with the same CN and OU values.

For more information, see ~~Provision groups to Active Directory Domain Services by using Microsoft Entra Cloud Sync~~How provisioning from Microsoft Entra ID to Active Directory works.

Transition group management

Then you start to manage group memberships in Microsoft Entra ID for the converted CloudGroupB. You provision it as a nested group within the on-premises group OnPremGroupA. If OnPremGroupA remains in-scope for sync, when the AD DS to Microsoft Entra ID sync configuration runs for OnPremGroupA, the membership reference for CloudGroupB doesn't sync. By design, the sync client doesn't recognize the cloud group membership references.

For more information about how group sync works with SOA in similar use cases, see ~~Nested Groups and membership references handling~~Nested group membership behavior.

How SOA applies to nested groups

@@ -35,7 +35,7 @@ If you plan to provision a converted SOA security group (not mail-enabled) back 1. Convert the Source of Authority (SOA) when ready.  1. Use custom expressions to ensure Cloud Sync provisions groups back to AD DS with the same CN and OU values.  -For more information, see [Provision groups to Active Directory Domain Services by using Microsoft Entra Cloud Sync](cloud-sync/tutorial-group-provisioning.md).+For more information, see [How provisioning from Microsoft Entra ID to Active Directory works](cloud-sync/how-provisioning-to-active-directory-works.md).  ### Transition group management @@ -62,7 +62,7 @@ Let's look at an example where you provision a security group named *CloudGroupB  Then you start to manage group memberships in Microsoft Entra ID for the converted *CloudGroupB*. You provision it as a nested group within the on-premises group *OnPremGroupA*. If *OnPremGroupA* remains in-scope for sync, when the AD DS to Microsoft Entra ID sync configuration runs for *OnPremGroupA*, the membership reference for *CloudGroupB* doesn't sync. By design, the sync client doesn't recognize the cloud group membership references. -For more information about how group sync works with SOA in similar use cases, see [Nested Groups and membership references handling](cloud-sync/tutorial-group-provisioning.md#nested-groups-and-membership-references-handling).+For more information about how group sync works with SOA in similar use cases, see [Nested group membership behavior](cloud-sync/how-provisioning-to-active-directory-works.md#nested-group-membership-behavior).  ### How SOA applies to nested groups