Daily.Entra.News
Aboutmerill.net
Microsoft Entra ID
Provisioning

Microsoft Entra provisioning setup (Preview)

28 August 2026New feature+378 / −99 lines

In brief

The article now documents provisioning users and groups from Microsoft Entra ID to on-premises AD DS, including prerequisites, deployment options, scoping filters, attribute mappings, and testing. Users-only and users-and-groups options are marked Preview.

What Entra admins need to know

Administrators configuring cloud-to-AD provisioning can use the expanded workflow and must choose the appropriate deployment scope, filters, and mappings before testing and enabling the configuration.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

ProvisionConfigure Microsoft Entra ID to Active Directory - Configurationprovisioning (preview)

The following document will guideThis article guides you through configuring Microsoft Entra Cloud Sync for provisioningto provision users and groups from Microsoft Entra ID to on-premises Active Directory. Directory Domain Services (AD DS). You create a configuration, choose which objects it provisions, set scoping filters and attribute value filtering, choose target containers, and customize attribute mappings.

Because the scoping choice determines whether attribute value filtering is available, scoping and attribute mapping are covered together here. When your configuration is complete, test and enable it, which is the same for all deployment options. The final section covers tasks you perform after provisioning runs, such as verifying results and moving a provisioned user.

If you are're looking for information on provisioning from AD to Microsoft Entra ID, see Configure provisioning from Active Directory to Microsoft Entra ID.

Prerequisites

[!INCLUDE deprecation]Complete the steps in Prerequisites for provisioning from Microsoft Entra ID to Active Directory before you continue.

Configure provisioningChoose a deployment option

All deployment options use the same configuration type, Microsoft Entra ID to AD sync. What differs is which object types you bring into scope:

OptionProvisionsAvailability
Groups onlySecurity groups and membershipsGenerally available
Users onlyUsersPreview
Users and groupsBoth, in one configurationPreview

For guidance on choosing an option and scale considerations, see Deployment options.

Create a configuration

To configure provisioning, follow these steps.

[!INCLUDE sign in]create a Microsoft Entra ID to AD provisioning configuration:

  1. Sign in to the Microsoft Entra admin center as at least a Hybrid Identity Administrator.

  2. Browse to Entra ID > Entra Connect > Cloud sync.

  3. Select New configuration.

  4. Select Microsoft Entra ID to AD sync.

  • :::image type="content" source="media/how-to-configure-entra-to-active-directory/entra-to-ad-1.png" alt-text="Screenshot of configuration selection." lightbox="media/how-to-configure-entra-to-active-directory/entra-to-ad-1.png":::

    1. On the configuration screen, select your domain and whether to enable password hash sync. Clickdomain. Select Create.

  • :::image type="content" source="media/how-to-configure/new-ux-configure-2.png" alt-text="Screenshot of a new configuration." lightbox="media/how-to-configure/new-ux-configure-2.png":::

    1. The Get started screen will open.opens. From here, you can continue configuring cloud sync.

    :::image type="content" source="media/how-to-configure-entra-to-active-directory/config-1.png" alt-text="Screenshot of the configuration sections." lightbox="media/how-to-configure-entra-to-active-directory/config-1.png":::

    1. The configuration is split in tointo the following 5 sections.
    five sections:
    Section Description
    1. Add scoping filtersscoping filters Use this section to define whatDefine which objects appearare in Microsoft Entra IDscope for provisioning.
    2. Map attributesattributes Use this section to mapMap attributes between your on-premisesMicrosoft Entra ID users/groups with Microsoft Entra objectsand AD objects.
    3. TestTest Test your configuration before deploying ityou deploy it.
    4. View default propertiesdefault properties View theReview default setting prior to enablingsettings and change them and make changes where appropriateappropriate.
    5. Enable your configurationyour configuration Once ready, enableEnable the configuration and users/groups willobjects begin synchronizingsynchronizing.

    Sections 1 and 2 are covered in this article. For sections 3–5, see Test and enable provisioning to Active Directory.

    Scope provisioningConfigure scoping filters

    Scoping filters determine which objects are provisioned. The Scoping filters page provides a read-only view of the current configuration. Select Edit to specific groups

    You can scopeopen the agent to synchronize all or specific security groups.

    For more information see Attribute based scope filtering and Reference for writing expressions for attribute mappings in Microsoft Entra ID and Scenario - Using directory extensions with group provisioning to Active Directory.

    You can configure groups and organizational units within a configuration. wizard.

    1. On the GettingGet started configuration screen. Click eitherscreen, select Add scoping filters next to the Add scoping filters icon, or on the clickselect Scoping filters on the left under Manage.

    :::image type="content" source="media/how-to-configure-entra-to-active-directory/config-2.png" alt-text="Screenshot of the scoping filters sections." lightbox="media/how-to-configure-entra-to-active-directory/config-2.png":::

    1. Select the scoping filter. The filter can be one of the following:
    • All security groups: Scopes the configuration to apply to all cloud security groups.
    • Selected security groups: Scopes the configuration to apply to specific security groups.
    1. For specific security groups select Edit groups and pick your desired groups from the list.
    1. You can use the Target Container box to scope groups that use a specific container. Accomplish this task by using the parentDistinguishedName attribute. Use either a constant, direct, or expression mapping.

    Multiple target containers can be configured using an attribute mapping expression with the Switch() function. With this expression, if the displayName value is Marketing or Sales, the group is created in the corresponding OU. If there's no match, then the group is created in the default OU.

    Switch([displayName],"OU=Default,OU=container,DC=contoso,DC=com","Marketing","OU=Marketing,OU=container,DC=contoso,DC=com","Sales","OU=Sales,OU=container,DC=contoso,DC=com")

    :::image type="content" source="media/how-to-configure-entra-to-active-directory/config-6.png" alt-text="Screenshot of the scoping filters expression." lightbox="media/how-to-configure-entra-to-active-directory/config-6.png":::

    1. Attribute based scope filtering is supported. For more information see Attribute based scope filtering and Reference for writing expressions for attribute mappings in Microsoft Entra ID and Scenario - Using directory extensions with group provisioning to Active Directory.
    2. Once your scoping filters are configured, click Save.
    3. After saving, you should see a message telling you what you still need to do to configure cloud sync. You can click the link to continue. :::image type="content" source="media/how-to-configure/new-ux-configure-16.png" alt-text="Screenshot of the nudge for scoping filters." lightbox="media/how-to-configure/new-ux-configure-16.png":::

    Scope provisioning to specific groups using directory extensions

    For more advanced scoping and filtering, you can configure the use of directory extensions. For an overview of directory extensions see Directory extensions for provisioning Microsoft Entra ID to Active Directory

    For a step-by-step tutorial on how to extend the schema and then use the directory extension attribute with cloud sync provisioning to AD, see Scenario - Using directory extensions with group provisioning to Active Directory.

    Attribute mapping

    Microsoft Entra Cloud Sync allows you to easily map attributes between your on-premises user/group objects and the objects in Microsoft Entra ID.

    :::image type="content" source="media/how-to-configure-attribute-mapping-entra-to-active-directory/config-3.scoping-filters-overview.png" alt-text="Screenshot of the default attribute mappings.Scoping filters page showing the current scope settings, assignment, group membership, and target containers." lightbox="media/how-to-configure-attribute-mapping-entra-to-active-directory/config-3.scoping-filters-overview.png":::

    • Scope by assignment

    In Edit mode, use Scope by assignment to choose whether to sync all objects or selected objects. Attribute value filtering is available with either choice, but it's only appropriate with one of them:

    • All users and groups — the next step is Scope by attribute. Add attribute value filters for every enabled object type (users, groups, or both), so that provisioning evaluates only the objects you need.

      :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/scope-all-users-groups.png" alt-text="Screenshot of the Scope by assignment step with All users and groups selected." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/scope-all-users-groups.png":::

    • Selected users and groups — the next step is Select users and groups, where you pick specific objects. Attribute value filtering is available in this mode but isn't recommended, because your selection already determines the scope. For more information, see Recommended configuration.

      :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/scope-selected-users-groups.png" alt-text="Screenshot of the Scope by assignment step with Selected users and groups selected." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/scope-selected-users-groups.png":::

    Attribute value filtering

    Attribute-based scope filtering narrows which objects are provisioned by evaluating their attribute values. You configure it in the Scope by attribute step, on the Users tab, the Groups tab, or both.

    Use it with All users and groups, where the filter is the only thing narrowing the scope: without one, every user and group in the tenant is evaluated on every cycle.

    :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/scope-by-attribute-all-users-groups.png" alt-text="Screenshot of the Scope by attribute step with All users and groups selected, warning that no attribute value filter is configured." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/scope-by-attribute-all-users-groups.png":::

    Don't use it with Selected users and groups, where your selection already narrows the scope, so a filter adds processing time without changing which objects are provisioned.

    :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/scope-by-attribute-selected-users-groups.png" alt-text="Screenshot of the Scope by attribute step with Selected users and groups selected, warning that attribute value filtering is unnecessary." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/scope-by-attribute-selected-users-groups.png":::

    The provisioning configuration displays a warning in both cases, but doesn't block you. For more information, see Recommended configuration.

    Default security clauses

    A default security clause is applied to groups on top of clauses that you create, by using AND logic:

    securityEnabled IS TRUE AND dirSyncEnabled IS FALSE AND mailEnabled IS FALSE

    The default security clause is evaluated before the clauses that you configure.

    Filtering logic

    A single clause defines one condition for one attribute value. Clauses within a single scoping filter are evaluated with AND — all must be TRUE.

    :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/attribute-scope-filter-and-logic.png" alt-text="Screenshot of an attribute scoping filter with two clauses that use AND logic." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/attribute-scope-filter-and-logic.png":::

    You can customizeMultiple scoping filters are evaluated with OR — if any filter is TRUE, the default object is provisioned.

    :::image type="content" source="media/how-to-attribute-mappings accordingmapping-entra-to-active-directory/attribute-scope-filter-or-logic.png" alt-text="Screenshot of two attribute scoping filters that use OR logic." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/attribute-scope-filter-or-logic.png":::

    Create an attribute-based filter

    To create a filter that evaluates an attribute value:

    1. Select Add Attribute scoping filter.
    2. In Name, enter a name for the filter.
    3. Under Attribute, select the attribute to your business needs. So, you can changeevaluate.
    4. Under Operator, select an operator (for example, EQUALS, NOT EQUALS, INCLUDES, REGEX MATCH).
    5. Under Value, enter a value.
    6. Select Save.

    Supported operators

    The following operators are supported:

    OperatorDescription
    EQUALSReturns TRUE if the evaluated attribute exactly matches the input string. The comparison is case-sensitive.
    GREATER_THANReturns TRUE if the evaluated attribute is greater than the specified value. The specified value and the evaluated attribute must be integers, for example, 0, 1, or delete existing attribute-mappings,2.
    GREATER_THAN_OR_EQUALSReturns TRUE if the evaluated attribute is greater than or create new attribute-mappings. equal to the specified value. The specified value and the evaluated attribute must be integers.
    IS FALSEReturns TRUE if the evaluated attribute contains a Boolean value of false.
    IS NOT NULLReturns TRUE if the evaluated attribute isn't empty.
    IS NULLReturns TRUE if the evaluated attribute is empty.
    IS TRUEReturns TRUE if the evaluated attribute contains a Boolean value of true.
    NOT EQUALSReturns TRUE if the evaluated attribute doesn't match the input string. The comparison is case-sensitive.
    NOT REGEX MATCHReturns TRUE if the evaluated attribute doesn't match a regular expression pattern. It returns FALSE if the attribute is null or empty.
    REGEX MATCHReturns TRUE if the evaluated attribute matches a regular expression pattern. For example, ([1-9][0-9]) matches any number from 10 through 99. The comparison is case-sensitive.

    Use regular expressions to filter

    For more advanced filtering, use REGEX MATCH to search an attribute string for a substring. For example, consider groups that have the following descriptions:

    • Contoso-Sales-US
    • Contoso-Marketing-US
    • Contoso-Operations-US
    • Contoso-LT-US

    After saving, you should see a message telling you what you still needTo provision only the Sales, Marketing, and Operations groups to do to configure cloud sync. You can clickActive Directory, use the link to continue.following regular expression:

    REGEX MATCH description (?:^|\W)Sales|Marketing|Operations(?:$|\W)

    The expression searches the group descriptions for the supplied words and provisions only matching groups.

    For more information,information about writing expressions, see attribute mapping and Reference for writing expressions for attribute mappings in Microsoft Entra ID.

    Directory

    Group membership to on-premises users

    When group synchronization is enabled, you can optionally provision membership from cloud groups to on-premises users in the Configure group membership step. This setting is off by default.

    :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/provision-membership-on-premises-users.png" alt-text="Screenshot of the Configure group membership step with the option to provision membership to on-premises users." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/provision-membership-on-premises-users.png":::

    Scope using directory extensions and custom attribute mapping.

    Microsoft Entra Cloud Sync allows you to extend the directory with extensions and provides for custom attribute mapping. For more informationadvanced scoping and filtering, you can use directory extensions. For an overview, see Directory extensions and custom attribute mappingDirectory extensions for provisioning Microsoft Entra ID to Active Directory. For a step-by-step tutorial, see Using directory extensions when provisioning to Active Directory.

    On-demand provisioningConfigure the target container

    Microsoft Entra Cloud Sync allowsUse the Target container to control the organizational unit (OU) where user and group objects are created in Active Directory. You can use a constant, direct, or expression mapping on the parentDistinguishedName attribute.

    :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/configure-target-container.png" alt-text="Screenshot of the Configure target container step showing the user and group target containers." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/configure-target-container.png":::

    • Users — the default user target container automatically preserves the original OU of a user whose Source of Authority (SOA) is converted to the cloud (the default parentDistinguishedName expression uses onPremisesDistinguishedName). A cloud-native user is created in CN=Users,DC=<selected AD domain>, which you can override.

      :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/edit-user-target-container-mapping.png" alt-text="Screenshot of the expression used to test configuration changes,map the user target container." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/edit-user-target-container-mapping.png":::

    • Groups — the default group target container is CN=Users,DC=<selected AD domain>. To place groups in different OUs by applying these changes to a single user or group. attribute, use an expression with the Switch() function. The following example routes groups by display name:

      Switch([displayName],"OU=Default,OU=container,DC=contoso,DC=com","Marketing","OU=Marketing,OU=container,DC=contoso,DC=com","Sales","OU=Sales,OU=container,DC=contoso,DC=com")

      :::image type="content" source="media/how-to-configure-attribute-mapping-entra-to-active-directory/config-5.multiple-target-containers.png" alt-text="Screenshot of an expression that configures multiple group target containers." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/multiple-target-containers.png":::

      Display name is a weak routing key because it can change and isn't guaranteed to follow a consistent pattern. To route groups by a stable value, or to keep a group in the organizational unit it already occupies, use a directory extension instead. For more information, see Preserve the OU path.

    Preserve the OU path

    How the original OU is preserved depends on the object type:

    • Users — preservation is built in. The default parentDistinguishedName mapping re-creates a SOA-converted user in their original OU, so no extra configuration is required.
    • Groups — the original OU isn't detected automatically. Use the GroupDN directory extension to capture the group's distinguished name (DN) before you convert its SOA, then reference that extension in the OU and common name (CN) mapping expressions.

    To set up the extension, see Preserve a group's organizational unit and name. Complete that setup before you convert the group to cloud-managed, then use the expressions that follow.

    Preserve a group's original organizational unit

    \ No newline at end of file To map a SOA-converted group to its original OU, adapt the sample expression by replacing extension_<AppIdWithoutHyphens>_GroupDN with the extension attribute name in your tenant, and <Default ParentDistinguishedName> with the target OU to use when the extension value is empty:

    IIF(
    IsPresent([extension_<AppIdWithoutHyphens>_GroupDN]),
    Replace(
        Mid(
            Mid(
                Replace([extension_<AppIdWithoutHyphens>_GroupDN], "\,", , , "\2C", , ),
                Instr(Replace([extension_<AppIdWithoutHyphens>_GroupDN], "\,", , , "\2C", , ), ",", , ),
                9999
            ),
            2,
            9999
        ),
        "\2C", , , ",", ,
    ),
    "<Default ParentDistinguishedName>"
)

    Set Default value (if null) to the target OU to use when the GroupDN extension is empty.

    Apply the expression to the target-container mapping:

    1. Under Group target container, select Edit attribute mapping.
    2. Change Mapping type to Expression.
    3. Paste the expression into the expression box.
    4. Select Apply, and then select Save.

    Preserve a group's original common name

    Use the same GroupDN extension to preserve the common name (CN). The expression extracts the CN from the stored distinguished name and uses the group display name and object ID as a fallback:

    IIF(
    IsPresent([extension_<AppIdWithoutHyphens>_GroupDN]),
    Replace(
        Replace(
            Replace(
                Word(Replace([extension_<AppIdWithoutHyphens>_GroupDN], "\,", , , "\2C", , ), 1, ","),
                "CN=", , , "", ,
            ),
            "cn=", , , "", ,
        ),
        "\2C", , , ",", ,
    ),
    Append(Append(Left(Trim([displayName]), 51), "_"), Mid([objectId], 25, 12))
)

    Apply the expression to the cn attribute mapping, then select Save schema.

    When you finish configuring scoping filters and target containers, select Save. A message tells you what to configure next; select the link to continue.

    Configure attribute mapping

    Microsoft Entra Cloud Sync maps attributes between your Microsoft Entra ID users/groups and the AD objects. Because the AD schema isn't discoverable, each Microsoft Entra ID to AD configuration uses a fixed set of default mappings, which you can customize for your business needs.

    Keep the same group name

    By default, sAMAccountName isn't synchronized from Microsoft Entra ID to Active Directory, so a newly created group in AD receives a randomly generated sAMAccountName. To keep a consistent group name in AD, create a custom mapping to sAMAccountName. For example, use the following expression:

    Join("_", [displayName], "Contoso_Group")

    The expression combines the displayName value with Contoso_Group. For example, a group with the display name Marketing receives the sAMAccountName value Marketing_Contoso_Group.

    Change other attribute mappings as needed

    The following tables list the default user and group attribute mappings. You can change any of these mappings based on your requirements — modify an existing mapping, delete one, or add a new one. Some mappings are managed by the service and can't be edited.

    To add a mapping:

    1. Browse to Entra ID > Entra Connect > Cloud sync.

    2. Under Configuration, select your Microsoft Entra ID to AD configuration.

    3. On the left, select Attribute mapping.

    4. At the top, select the object type you're mapping: user, group, or contact.

    5. Select Add attribute mapping, and then select the mapping type:

      • Direct — the target attribute takes the value of the source attribute.
      • Constant — the target attribute takes a fixed string that you specify.
      • Expression — the target attribute takes the result of an expression.
      • None — the target attribute is left unmodified.

    6. Fill in the remaining options for the mapping type you chose, select when to apply the mapping, and then select Apply.

    7. Select Save schema. Saving the schema triggers a synchronization.

    For more information about writing expressions, see Reference for writing expressions for attribute mappings in Microsoft Entra ID.

    User attribute mappings

    Target attribute (Active Directory)Source attribute (Microsoft Entra ID)Mapping type
    accountDisabledNot([accountEnabled])Expression
    cnAppend(Append(Left(Trim([displayName]), 51), "_"), Mid([objectId], 25, 12))Expression
    coIgnoreFlowIfNullOrEmpty(Trim([country]))Expression
    companyIgnoreFlowIfNullOrEmpty(Trim([companyName]))Expression
    departmentIgnoreFlowIfNullOrEmpty(Trim([department]))Expression
    displayNamedisplayNameDirect
    employeeIDIgnoreFlowIfNullOrEmpty([employeeId])Expression
    givenNameIgnoreFlowIfNullOrEmpty(Trim([givenName]))Expression
    lIgnoreFlowIfNullOrEmpty(Trim([city]))Expression
    managermanagerDirect
    mobileIgnoreFlowIfNullOrEmpty(Trim([mobile]))Expression
    msDS-ObjectSoaCloudConstant
    parentDistinguishedNameexpression preserving the original OUExpression
    postalCodeIgnoreFlowIfNullOrEmpty(Trim([postalCode]))Expression
    preferredLanguageIgnoreFlowIfNullOrEmpty(Trim([preferredLanguage]))Expression
    sAMAccountNameLeft(Item(Split([userPrincipalName], "@"), 1), 15)Expression
    snIgnoreFlowIfNullOrEmpty(Trim([surname]))Expression
    stIgnoreFlowIfNullOrEmpty(Trim([state]))Expression
    streetAddressIgnoreFlowIfNullOrEmpty(Trim([streetAddress]))Expression
    userPrincipalNameIIF(IsPresent([onPremisesUserPrincipalName]), [onPremisesUserPrincipalName], Append(Item(Split([userPrincipalName], "@"), 1), Append("@", %DomainFQDN%)))Expression

    Some user mappings (for example, adminDescription and msDS-ExternalDirectoryObjectId) are managed by the service, aren't visible in the UI, and must not be edited.

    Group attribute mappings

    Target attribute (Active Directory)Source attribute (Microsoft Entra ID)Mapping type
    cnAppend(Append(Left(Trim([displayName]),51),"_"),Mid([objectId],25,12))Expression
    descriptionLeft(Trim([description]),448)Expression
    displayNamedisplayNameDirect
    isSecurityGroupTrueConstant
    membermembersDirect
    parentDistinguishedNameCN=Users,DC=<selected AD domain>Constant
    UniversalScopeTrueConstant

    Service-managed group mappings (adminDescription, msDS-ExternalDirectoryObjectId, ObjectGUID) aren't visible in the UI and must not be edited.

    Directory extensions and custom attribute mapping

    Microsoft Entra Cloud Sync lets you add directory extensions and map them to custom attributes. For more information, see Directory extensions for provisioning Microsoft Entra ID to Active Directory.

    When your attribute mappings are complete, select Save schema. A message tells you what to configure next; select the link to continue.

    Verify and manage provisioned objects

    The following tasks apply after provisioning runs. Before you work through them, test and enable your configuration.

    Verify provisioning

    After you convert SOA and the object is in scope, run provisioning and confirm the result. These steps apply to all three deployment options: users only, groups only, or users and groups.

    Groups:

    • Confirm that the SOA-converted group is available in the provisioning configuration's group scope.

      :::image type="content" source="media/tutorial-group-provision/group-scope.png" alt-text="Screenshot of a SOA-converted group selected in the provisioning configuration's group scope." lightbox="media/tutorial-group-provision/group-scope.png":::

    • When the job runs, the SOA-converted group is provisioned successfully. In Provisioning logs, search for the group and verify it was provisioned.

      :::image type="content" source="media/tutorial-group-provision/provisioning-logs.png" alt-text="Screenshot of a successful group update in the provisioning logs." lightbox="media/tutorial-group-provision/provisioning-logs.png":::

    • Open the provisioning log details and confirm that the group was matched with an existing target group.

      :::image type="content" source="media/tutorial-group-provision/matched.png" alt-text="Screenshot of provisioning log details showing a group matched and updated in Active Directory." lightbox="media/tutorial-group-provision/matched.png":::

    • On the Modified Properties tab, confirm that the target group's adminDescription and cn attributes are updated.

      :::image type="content" source="media/tutorial-group-provision/confirm-updates.png" alt-text="Screenshot of provisioning log modified properties showing updated cn and adminDescription attributes." lightbox="media/tutorial-group-provision/confirm-updates.png":::

    Verify in AD DS

    In Active Directory Users and Computers, confirm that the original group is updated in its expected OU rather than a duplicate group being created.

    :::image type="content" source="media/tutorial-group-provision/verify.png" alt-text="Screenshot of a provisioned security group in its Active Directory organizational unit." lightbox="media/tutorial-group-provision/verify.png":::

    Open the group properties and verify that the expected group name, scope, and attributes are present.

    :::image type="content" source="media/tutorial-group-provision/updated-group.png" alt-text="Screenshot of the updated SOA-converted group's general properties in Active Directory." lightbox="media/tutorial-group-provision/updated-group.png":::

    :::image type="content" source="media/tutorial-group-provision/group-properties.png" alt-text="Screenshot of the updated SOA-converted group's Attribute Editor showing its distinguished name, cn, and adminDescription values." lightbox="media/tutorial-group-provision/group-properties.png":::

    Cloud skips changes made in AD after SOA conversion

    After you convert an object's SOA to the cloud, the cloud is the source of authority. If you edit an attribute of that object directly in AD DS (for example, rename a group), Cloud Sync skips the object during provisioning. In Provisioning logs, the object shows as Skipped, and the details explain that the object isn't synced because its SOA is converted to the cloud.

    :::image type="content" source="media/tutorial-group-provision/update-group-name.png" alt-text="Screenshot of an SOA-converted group's name being changed directly in Active Directory." lightbox="media/tutorial-group-provision/update-group-name.png":::

    :::image type="content" source="media/tutorial-group-provision/skipped.png" alt-text="Screenshot of the provisioning on-demand.logs showing the modified SOA-converted group with a Skipped status." lightbox="media/how-to-configure-entra-to-active-directory/config-5.tutorial-group-provision/skipped.png":::

    You can use this to validate and verify:::image type="content" source="media/tutorial-group-provision/sync-blocked.png" alt-text="Screenshot of provisioning log details explaining that export was skipped because the changes madegroup's SOA was converted to the configuration were applied properlycloud." lightbox="media/tutorial-group-provision/sync-blocked.png":::

    Move a provisioned user to a different organizational unit

    After a user is provisioned, changing the Target container doesn't move them, and are being correctly synchronizedmoving the object manually in AD DS is reverted on the next sync cycle. This behavior is expected, because the default parentDistinguishedName expression checks whether the user already has an on-premises location:

    IIF(IsNullOrEmpty([onPremisesDistinguishedName]), "OU=Cloud_Users,DC=contoso,DC=com", Replace([onPremisesDistinguishedName], , "^.*?,(?=(?:CN|OU|DC)=)", , "", , ))

    When onPremisesDistinguishedName is empty, the user is created in the constant target container you specified. When it's populated, the expression derives the OU from that attribute instead and ignores the constant. That precedence preserves the original OU of a user whose SOA is converted to the cloud. It's also why an already-provisioned user keeps returning to the OU recorded on their cloud object.

    A cloud-native user has no onPremisesDistinguishedName until the first provisioning cycle, which writes the value back to the cloud object. For the full list of attributes written back, see On-premises attributes written back to Microsoft Entra ID.

    :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/on-premises-distinguished-name-original-organizational-unit.png" alt-text="Screenshot of a user's on-premises properties in Microsoft Entra ID. ID showing the on-premises distinguished name." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/on-premises-distinguished-name-original-organizational-unit.png":::

    After testing, you should seeTo move a message telling you what you still need to do to configure cloud sync. You can clickuser, use the link to continue.

    For more information, see on-demand provisioning.

    Accidental deletions and email notifications

    The default properties section provides information on accidental deletions and email notifications.

    The accidental delete feature is designed to protect you from accidental configuration changes and changes to your on-premises directoryoption that would affect many users and groups.

    This feature allows you to:matches the scope of the change:

    • Configure the ability to prevent accidental deletes automatically.
    • Set the # of objects (threshold) beyond which the configuration will take effect
    • Set upAll users that match a notification email address so they can get an email notification once the sync job in question is put in quarantine for this scenario

    For more information, see Accidental deletes

    Click the pencilmapping rule next to Basics to— change the defaults in a configuration.

    Enable your configuration

    Once you've finalizedtarget container mapping so it points to the new OU, then select Save. Provisioning restarts and tested your configuration, you can enable it.

    Click Enable configuration to enable it.

    Quarantines

    Cloud sync monitorsmoves every user that matches the health of your configuration and places unhealthy objects in a quarantine state. If most or all of the calls made against the target system consistently fail because of an error, for example, invalid admin credentials, the sync job is marked as in quarantine. For more information, see the troubleshooting sectionmapping rules on quarantines.

    Restart provisioning

    If you don't want to wait for the next scheduled run, triggercycle.

  • A single user — update that user's onPremisesDistinguishedName attribute in Microsoft Entra ID.
  • A user that's moving to a different domain — remove the provisioning run by usinguser from the Restart sync button. [!INCLUDE sign in] 4. Under Configuration, select your configuration.
    1. Atcurrent configuration's scope, then add the top, select Restart sync.

    Remove a configuration

    To delete a configuration, follow these steps.

    [!INCLUDE sign in] 3. Under Configuration, select your configuration.

    1. Atuser to the topscope of the configuration screen,that targets the other domain.

      2. The onPremisesDistinguishedName attribute is read-only unless you're assigned at least the Hybrid Identity Administrator role. The Microsoft Entra admin center doesn't expose on-premises attributes for editing, so use Microsoft Graph to update a single user:

      PATCH https://graph.microsoft.com/v1.0/users/{user-id}
Content-Type: application/json

{
    "onPremisesDistinguishedName": "CN=Cloud User,OU=Cloud_Users,DC=contoso,DC=com"
}

      A 204 No Content response confirms the update. The user moves to the new OU on the next sync cycle.

      :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/graph-update-on-premises-distinguished-name.png" alt-text="Screenshot of a Microsoft Graph PATCH request that updates the on-premises distinguished name and returns 204 No Content." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/graph-update-on-premises-distinguished-name.png":::

      To confirm the move, open the user's entry in Provisioning logs and select DeleteModified Properties. The parentDistinguishedName row shows the old and new values.

      :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/provisioning-log-parent-distinguished-name-updated.png" alt-text="Screenshot of provisioning log details showing the old and new parentDistinguishedName values." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/provisioning-log-parent-distinguished-name-updated.png":::

      Roll back a SOA-converted user or group

      If you roll back a SOA-converted user or group so that AD DS owns it again, provisioning stops syncing changes for that object and removes it from the configuration scope. The on-premises object isn't deleted, and on-premises control resumes in the next sync cycle.

      To confirm a rollback, check the Audit logs.

    Next steps

    • Daily Entra.News

    Get daily email updates

    Get a concise summary of the latest Microsoft Entra updates delivered straight to your inbox.

    Loading the secure signup form…