Daily.Entra.News
Aboutmerill.net
Microsoft Entra ID
Provisioning

Configure - Provisioning Microsoft Entra ID to Active Directory using Microsoft Entra Cloud Sync for Groups

31 August 2026Doc update+99 / −378 lines

In brief

The article was rewritten for provisioning groups from Microsoft Entra ID to Active Directory, adding updated setup steps, screenshots, and sections for scoping, attribute mapping, testing, and default settings. Previous combined users-and-groups guidance was removed, and a deprecation notice was added.

What Entra admins need to know

Administrators configuring group provisioning should use the updated procedure. No required action is stated.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

ConfigureProvision Microsoft Entra ID to Active Directory provisioning (preview)- Configuration

This article guidesThe following document will guide you through configuring Microsoft Entra Cloud Sync to provision users andfor provisioning groups from Microsoft Entra ID to on-premises Active Directory Domain Services (AD DS). You create a configuration, choose which objects it provisions, set scoping filters and attribute value filtering, choose target containers, and customize attribute mappings.

Because the scoping choice determines whether attribute value filtering is available, scoping and attribute mapping are covered together here. When your configuration is complete, test and enable it, which is the same for all deployment options. The final section covers tasks you perform after provisioning runs, such as verifying results and moving a provisioned user.

Directory. If you're are looking for information on provisioning from AD to Microsoft Entra ID, see Configure - Provisioning Active Directory to Microsoft Entra ID using Microsoft Entra Cloud Sync.

Prerequisites

Complete the steps in Prerequisites for provisioning from Microsoft Entra ID to Active Directory before you continue.[!INCLUDE deprecation]

Choose a deployment option

All deployment options use the same configuration type, Microsoft Entra ID to AD sync. What differs is which object types you bring into scope:

OptionProvisionsAvailability
Groups onlySecurity groups and membershipsGenerally available
Users onlyUsersPreview
Users and groupsBoth, in one configurationPreview

For guidance on choosing an option and scale considerations, see Deployment options.

Create a configurationConfigure provisioning

To create a Microsoft Entra ID to AD provisioning configuration:configure provisioning, follow these steps.

[!INCLUDE sign in]

  1. Sign in to the Microsoft Entra admin center as at least a Hybrid Identity Administrator.

  2. Browse to Entra ID > Entra Connect > Cloud sync.

  3. Select New configuration.

  4. Select Microsoft Entra ID to AD sync.

:::image type="content" source="media/how-to-configure-entra-to-active-directory/entra-to-ad-1.png" alt-text="Screenshot of configuration selection." lightbox="media/how-to-configure-entra-to-active-directory/entra-to-ad-1.png":::

  1. On the configuration screen, select your domain. Selectdomain and whether to enable password hash sync. Click Create.

:::image type="content" source="media/how-to-configure/new-ux-configure-2.png" alt-text="Screenshot of a new configuration." lightbox="media/how-to-configure/new-ux-configure-2.png":::

  1. The Get started screen opens.will open. From here, you can continue configuring cloud sync.

:::image type="content" source="media/how-to-configure-entra-to-active-directory/config-1.png" alt-text="Screenshot of the configuration sections." lightbox="media/how-to-configure-entra-to-active-directory/config-1.png":::

  1. The configuration is split intoin to the following five sections:5 sections.
Section Description
1. Add scoping filtersscoping filters Define whichUse this section to define what objects areappear in scope for provisioning.Microsoft Entra ID
2. Map attributesattributes MapUse this section to map attributes between your on-premises users/groups with Microsoft Entra ID users/groups and AD objects.objects
3. TestTest Test your configuration before you deploy it.deploying it
4. View default propertiesdefault properties ReviewView the default settingssetting prior to enabling them and change themmake changes where appropriate.appropriate
5. Enable your configurationyour configuration EnableOnce ready, enable the configuration and objectsusers/groups will begin synchronizing.synchronizing

Scope provisioning to specific groups

Sections 1You can scope the agent to synchronize all or specific security groups.

For more information see Attribute based scope filtering and 2 are covered in this article. For sections 3–5, see Test and enable provisioning to Active DirectoryReference for writing expressions for attribute mappings in Microsoft Entra ID and Scenario - Using directory extensions with group provisioning to Active Directory.

Configure scoping filters

Scoping filters determine which objects are provisioned. The Scoping filters page providesYou can configure groups and organizational units within a read-only view of the current configuration. Select Edit to open the wizard.

  1. On the GetGetting started screen, selectconfiguration screen. Click either Add scoping filters, next to the Add scoping filters icon or selecton the click Scoping filters on the left under Manage.

:::image type="content" source="media/how-to-configure-entra-to-active-directory/config-2.png" alt-text="Screenshot of the scoping filters sections." lightbox="media/how-to-configure-entra-to-active-directory/config-2.png":::

  1. Select the scoping filter. The filter can be one of the following:
  • All security groups: Scopes the configuration to apply to all cloud security groups.
  • Selected security groups: Scopes the configuration to apply to specific security groups.
  1. For specific security groups select Edit groups and pick your desired groups from the list.
  1. You can use the Target Container box to scope groups that use a specific container. Accomplish this task by using the parentDistinguishedName attribute. Use either a constant, direct, or expression mapping.

Multiple target containers can be configured using an attribute mapping expression with the Switch() function. With this expression, if the displayName value is Marketing or Sales, the group is created in the corresponding OU. If there's no match, then the group is created in the default OU.

Switch([displayName],"OU=Default,OU=container,DC=contoso,DC=com","Marketing","OU=Marketing,OU=container,DC=contoso,DC=com","Sales","OU=Sales,OU=container,DC=contoso,DC=com")

:::image type="content" source="media/how-to-configure-entra-to-active-directory/config-6.png" alt-text="Screenshot of the scoping filters expression." lightbox="media/how-to-configure-entra-to-active-directory/config-6.png":::

  1. Attribute based scope filtering is supported. For more information see Attribute based scope filtering and Reference for writing expressions for attribute mappings in Microsoft Entra ID and Scenario - Using directory extensions with group provisioning to Active Directory.
  2. Once your scoping filters are configured, click Save.
  3. After saving, you should see a message telling you what you still need to do to configure cloud sync. You can click the link to continue. :::image type="content" source="media/how-to-configure/new-ux-configure-16.png" alt-text="Screenshot of the nudge for scoping filters." lightbox="media/how-to-configure/new-ux-configure-16.png":::

Scope provisioning to specific groups using directory extensions

For more advanced scoping and filtering, you can configure the use of directory extensions. For an overview of directory extensions see Directory extensions for provisioning Microsoft Entra ID to Active Directory

For a step-by-step tutorial on how to extend the schema and then use the directory extension attribute with cloud sync provisioning to AD, see Scenario - Using directory extensions with group provisioning to Active Directory.

Attribute mapping

Microsoft Entra Cloud Sync allows you to easily map attributes between your on-premises user/group objects and the objects in Microsoft Entra ID.

:::image type="content" source="media/how-to-attribute-mapping-configure-entra-to-active-directory/scoping-filters-overview.config-3.png" alt-text="Screenshot of the Scoping filters page showing the current scope settings, assignment, group membership, and target containers.default attribute mappings." lightbox="media/how-to-attribute-mapping-configure-entra-to-active-directory/scoping-filters-overview.config-3.png":::

Scope by assignment

In Edit mode, use Scope by assignmentYou can customize the default attribute-mappings according to choose whetheryour business needs. So, you can change or delete existing attribute-mappings, or create new attribute-mappings.

After saving, you should see a message telling you what you still need to sync all objects or selected objects. Attribute value filtering is available with either choice, but it's only appropriate with one of them:

  • All users and groups —do to configure cloud sync. You can click the next step is Scope by attribute. Add attribute value filters for every enabled object type (users, groups, or both), so that provisioning evaluates only the objects you need.link to continue.

    :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/scope-all-users-groups.png" alt-text="Screenshot of the Scope by assignment step with All users and groups selected." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/scope-all-users-groups.png":::

  • Selected users and groups — the next step is Select users and groups, where you pick specific objects. Attribute value filtering is available in this mode but isn't recommended, because your selection already determines the scope. For more information, see Recommended configurationattribute mapping and Reference for writing expressions for attribute mappings in Microsoft Entra ID.

    Directory extensions and custom attribute mapping.

    :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/scope-selected-users-groups.png" alt-text="Screenshot ofMicrosoft Entra Cloud Sync allows you to extend the Scope by assignment stepdirectory with Selected usersextensions and groups selected." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/scope-selected-users-groups.png":::

Attribute value filtering

Attribute-based scope filtering narrows which objects are provisioned by evaluating their attribute values. You configure it in the Scope by attribute step, on the Users tab, the Groups tab, or both.

Use it with All users and groups, where the filter is the only thing narrowing the scope: without one, every user and group in the tenant is evaluated on every cycle.

:::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/scope-by-attribute-all-users-groups.png" alt-text="Screenshot of the Scope by attribute step with All users and groups selected, warning that no attribute value filter is configured." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/scope-by-attribute-all-users-groups.png":::

Don't use it with Selected users and groups, where your selection already narrows the scope, so a filter adds processing time without changing which objects are provisioned.

:::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/scope-by-attribute-selected-users-groups.png" alt-text="Screenshot of the Scope by attribute step with Selected users and groups selected, warning that attribute value filtering is unnecessary." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/scope-by-attribute-selected-users-groups.png":::

The provisioning configuration displays a warning in both cases, but doesn't block you. For more information, see Recommended configuration.

Default security clauses

A default security clause is applied to groups on top of clauses that you create, by using AND logic:

securityEnabled IS TRUE AND dirSyncEnabled IS FALSE AND mailEnabled IS FALSE

The default security clause is evaluated before the clauses that you configure.

Filtering logic

A single clause defines one conditionprovides for onecustom attribute value. Clauses within a single scoping filter are evaluated with AND — all must be TRUE.

:::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/attribute-scope-filter-and-logic.png" alt-text="Screenshot of an attribute scoping filter with two clauses that use AND logic." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/attribute-scope-filter-and-logic.png":::

Multiple scoping filters are evaluated with OR — if any filter is TRUE, the object is provisioned.

:::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/attribute-scope-filter-or-logic.png" alt-text="Screenshot of two attribute scoping filters that use OR logic." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/attribute-scope-filter-or-logic.png":::

Create an attribute-based filter

To create a filter that evaluates an attribute value:

  1. Select Add Attribute scoping filter.
  2. In Name, enter a name for the filter.
  3. Under Attribute, select the attribute to evaluate.
  4. Under Operator, select an operator (for example, EQUALS, NOT EQUALS, INCLUDES, REGEX MATCH).
  5. Under Value, enter a value.
  6. Select Save.

Supported operators

The following operators are supported:

OperatorDescription
EQUALSReturns TRUE if the evaluated attribute exactly matches the input string. The comparison is case-sensitive.
GREATER_THANReturns TRUE if the evaluated attribute is greater than the specified value. The specified value and the evaluated attribute must be integers, for example, 0, 1, or 2.
GREATER_THAN_OR_EQUALSReturns TRUE if the evaluated attribute is greater than or equal to the specified value. The specified value and the evaluated attribute must be integers.
IS FALSEReturns TRUE if the evaluated attribute contains a Boolean value of false.
IS NOT NULLReturns TRUE if the evaluated attribute isn't empty.
IS NULLReturns TRUE if the evaluated attribute is empty.
IS TRUEReturns TRUE if the evaluated attribute contains a Boolean value of true.
NOT EQUALSReturns TRUE if the evaluated attribute doesn't match the input string. The comparison is case-sensitive.
NOT REGEX MATCHReturns TRUE if the evaluated attribute doesn't match a regular expression pattern. It returns FALSE if the attribute is null or empty.
REGEX MATCHReturns TRUE if the evaluated attribute matches a regular expression pattern. For example, ([1-9][0-9]) matches any number from 10 through 99. The comparison is case-sensitive.

Use regular expressions to filter

For more advanced filtering, use REGEX MATCH to search an attribute string for a substring. For example, consider groups that have the following descriptions:

  • Contoso-Sales-US
  • Contoso-Marketing-US
  • Contoso-Operations-US
  • Contoso-LT-US

To provision only the Sales, Marketing, and Operations groups to Active Directory, use the following regular expression:

REGEX MATCH description (?:^|\W)Sales|Marketing|Operations(?:$|\W)

The expression searches the group descriptions for the supplied words and provisions only matching groups.

mapping. For more information about writing expressions, see Reference for writing expressions for attribute mappings in Microsoft Entra ID.

Group membership to on-premises users

When group synchronization is enabled, you can optionally provision membership from cloud groups to on-premises users in the Configure group membership step. This setting is off by default.

:::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/provision-membership-on-premises-users.png" alt-text="Screenshot of the Configure group membership step with the option to provision membership to on-premises users." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/provision-membership-on-premises-users.png":::

Scope using directory extensions

For more advanced scoping and filtering, you can use directory extensions. For an overview, see Directory extensions for provisioning Microsoft Entra ID to Active Directory. For a step-by-step tutorial, see Using directory extensions when provisioning to Active DirectoryDirectory extensions and custom attribute mapping.

Configure the target containerOn-demand provisioning

Use the Target containerMicrosoft Entra Cloud Sync allows you to control the organizational unit (OU) wheretest configuration changes, by applying these changes to a single user and group objects are created in Active Directory. You can use a constant, direct, or expression mapping on the parentDistinguishedName attribute.group.

:::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/configure-target-container.png" alt-text="Screenshot of the Configure target container step showing the user and group target containers." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/configure-target-container.png":::

  • Users — the default user target container automatically preserves the original OU of a user whose Source of Authority (SOA) is converted to the cloud (the default parentDistinguishedName expression uses onPremisesDistinguishedName). A cloud-native user is created in CN=Users,DC=<selected AD domain>, which you can override.

    :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/edit-user-target-container-mapping.png" alt-text="Screenshot of the expression used to map the user target container." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/edit-user-target-container-mapping.png":::

  • Groups — the default group target container is CN=Users,DC=<selected AD domain>. To place groups in different OUs by attribute, use an expression with the Switch() function. The following example routes groups by display name:

    Switch([displayName],"OU=Default,OU=container,DC=contoso,DC=com","Marketing","OU=Marketing,OU=container,DC=contoso,DC=com","Sales","OU=Sales,OU=container,DC=contoso,DC=com")

    :::image type="content" source="media/how-to-attribute-mapping-configure-entra-to-active-directory/multiple-target-containers.png" alt-text="Screenshot of an expression that configures multiple group target containers." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/multiple-target-containers.png":::

    Display name is a weak routing key because it can change and isn't guaranteed to follow a consistent pattern. To route groups by a stable value, or to keep a group in the organizational unit it already occupies, use a directory extension instead. For more information, see Preserve the OU path.

Preserve the OU path

How the original OU is preserved depends on the object type:

  • Users — preservation is built in. The default parentDistinguishedName mapping re-creates a SOA-converted user in their original OU, so no extra configuration is required.
  • Groups — the original OU isn't detected automatically. Use the GroupDN directory extension to capture the group's distinguished name (DN) before you convert its SOA, then reference that extension in the OU and common name (CN) mapping expressions.

To set up the extension, see Preserve a group's organizational unit and name. Complete that setup before you convert the group to cloud-managed, then use the expressions that follow.

Preserve a group's original organizational unit

To map a SOA-converted group to its original OU, adapt the sample expression by replacing extension_<AppIdWithoutHyphens>_GroupDN with the extension attribute name in your tenant, and <Default ParentDistinguishedName> with the target OU to use when the extension value is empty:

IIF(
    IsPresent([extension_<AppIdWithoutHyphens>_GroupDN]),
    Replace(
        Mid(
            Mid(
                Replace([extension_<AppIdWithoutHyphens>_GroupDN], "\,", , , "\2C", , ),
                Instr(Replace([extension_<AppIdWithoutHyphens>_GroupDN], "\,", , , "\2C", , ), ",", , ),
                9999
            ),
            2,
            9999
        ),
        "\2C", , , ",", ,
    ),
    "<Default ParentDistinguishedName>"
)

Set Default value (if null) to the target OU to use when the GroupDN extension is empty.

Apply the expression to the target-container mapping:

  1. Under Group target container, select Edit attribute mapping.
  2. Change Mapping type to Expression.
  3. Paste the expression into the expression box.
  4. Select Apply, and then select Save.

Preserve a group's original common name

Use the same GroupDN extension to preserve the common name (CN). The expression extracts the CN from the stored distinguished name and uses the group display name and object ID as a fallback:

IIF(
    IsPresent([extension_<AppIdWithoutHyphens>_GroupDN]),
    Replace(
        Replace(
            Replace(
                Word(Replace([extension_<AppIdWithoutHyphens>_GroupDN], "\,", , , "\2C", , ), 1, ","),
                "CN=", , , "", ,
            ),
            "cn=", , , "", ,
        ),
        "\2C", , , ",", ,
    ),
    Append(Append(Left(Trim([displayName]), 51), "_"), Mid([objectId], 25, 12))
)

Apply the expression to the cn attribute mapping, then select Save schema.

When you finish configuring scoping filters and target containers, select Save. A message tells you what to configure next; select the link to continue.

Configure attribute mapping

Microsoft Entra Cloud Sync maps attributes between your Microsoft Entra ID users/groups and the AD objects. Because the AD schema isn't discoverable, each Microsoft Entra ID to AD configuration uses a fixed set of default mappings, which you can customize for your business needs.

Keep the same group name

By default, sAMAccountName isn't synchronized from Microsoft Entra ID to Active Directory, so a newly created group in AD receives a randomly generated sAMAccountName. To keep a consistent group name in AD, create a custom mapping to sAMAccountName. For example, use the following expression:

Join("_", [displayName], "Contoso_Group")

The expression combines the displayName value with Contoso_Group. For example, a group with the display name Marketing receives the sAMAccountName value Marketing_Contoso_Group.

Change other attribute mappings as needed

The following tables list the default user and group attribute mappings. You can change any of these mappings based on your requirements — modify an existing mapping, delete one, or add a new one. Some mappings are managed by the service and can't be edited.

To add a mapping:

  1. Browse to Entra ID > Entra Connect > Cloud sync.

  2. Under Configuration, select your Microsoft Entra ID to AD configuration.

  3. On the left, select Attribute mapping.

  4. At the top, select the object type you're mapping: user, group, or contact.

  5. Select Add attribute mapping, and then select the mapping type:

    • Direct — the target attribute takes the value of the source attribute.
    • Constant — the target attribute takes a fixed string that you specify.
    • Expression — the target attribute takes the result of an expression.
    • None — the target attribute is left unmodified.

  6. Fill in the remaining options for the mapping type you chose, select when to apply the mapping, and then select Apply.

  7. Select Save schema. Saving the schema triggers a synchronization.

For more information about writing expressions, see Reference for writing expressions for attribute mappings in Microsoft Entra ID.

User attribute mappings

Target attribute (Active Directory)Source attribute (Microsoft Entra ID)Mapping type
accountDisabledNot([accountEnabled])Expression
cnAppend(Append(Left(Trim([displayName]), 51), "_"), Mid([objectId], 25, 12))Expression
coIgnoreFlowIfNullOrEmpty(Trim([country]))Expression
companyIgnoreFlowIfNullOrEmpty(Trim([companyName]))Expression
departmentIgnoreFlowIfNullOrEmpty(Trim([department]))Expression
displayNamedisplayNameDirect
employeeIDIgnoreFlowIfNullOrEmpty([employeeId])Expression
givenNameIgnoreFlowIfNullOrEmpty(Trim([givenName]))Expression
lIgnoreFlowIfNullOrEmpty(Trim([city]))Expression
managermanagerDirect
mobileIgnoreFlowIfNullOrEmpty(Trim([mobile]))Expression
msDS-ObjectSoaCloudConstant
parentDistinguishedNameexpression preserving the original OUExpression
postalCodeIgnoreFlowIfNullOrEmpty(Trim([postalCode]))Expression
preferredLanguageIgnoreFlowIfNullOrEmpty(Trim([preferredLanguage]))Expression
sAMAccountNameLeft(Item(Split([userPrincipalName], "@"), 1), 15)Expression
snIgnoreFlowIfNullOrEmpty(Trim([surname]))Expression
stIgnoreFlowIfNullOrEmpty(Trim([state]))Expression
streetAddressIgnoreFlowIfNullOrEmpty(Trim([streetAddress]))Expression
userPrincipalNameIIF(IsPresent([onPremisesUserPrincipalName]), [onPremisesUserPrincipalName], Append(Item(Split([userPrincipalName], "@"), 1), Append("@", %DomainFQDN%)))Expression

Some user mappings (for example, adminDescription and msDS-ExternalDirectoryObjectId) are managed by the service, aren't visible in the UI, and must not be edited.

Group attribute mappings

Target attribute (Active Directory)Source attribute (Microsoft Entra ID)Mapping type
cnAppend(Append(Left(Trim([displayName]),51),"_"),Mid([objectId],25,12))Expression
descriptionLeft(Trim([description]),448)Expression
displayNamedisplayNameDirect
isSecurityGroupTrueConstant
membermembersDirect
parentDistinguishedNameCN=Users,DC=<selected AD domain>Constant
UniversalScopeTrueConstant

Service-managed group mappings (adminDescription, msDS-ExternalDirectoryObjectId, ObjectGUID) aren't visible in the UI and must not be edited.

Directory extensions and custom attribute mapping

Microsoft Entra Cloud Sync lets you add directory extensions and map them to custom attributes. For more information, see Directory extensions for provisioning Microsoft Entra ID to Active Directory.

When your attribute mappings are complete, select Save schema. A message tells you what to configure next; select the link to continue.

Verify and manage provisioned objects

The following tasks apply after provisioning runs. Before you work through them, test and enable your configuration.

Verify provisioning

After you convert SOA and the object is in scope, run provisioning and confirm the result. These steps apply to all three deployment options: users only, groups only, or users and groups.

Groups:

  • Confirm that the SOA-converted group is available in the provisioning configuration's group scope.

    :::image type="content" source="media/tutorial-group-provision/group-scope.png" alt-text="Screenshot of a SOA-converted group selected in the provisioning configuration's group scope." lightbox="media/tutorial-group-provision/group-scope.png":::

  • When the job runs, the SOA-converted group is provisioned successfully. In Provisioning logs, search for the group and verify it was provisioned.

    :::image type="content" source="media/tutorial-group-provision/provisioning-logs.png" alt-text="Screenshot of a successful group update in the provisioning logs." lightbox="media/tutorial-group-provision/provisioning-logs.png":::

  • Open the provisioning log details and confirm that the group was matched with an existing target group.

    :::image type="content" source="media/tutorial-group-provision/matched.png" alt-text="Screenshot of provisioning log details showing a group matched and updated in Active Directory." lightbox="media/tutorial-group-provision/matched.png":::

  • On the Modified Properties tab, confirm that the target group's adminDescription and cn attributes are updated.

    :::image type="content" source="media/tutorial-group-provision/confirm-updates.png" alt-text="Screenshot of provisioning log modified properties showing updated cn and adminDescription attributes." lightbox="media/tutorial-group-provision/confirm-updates.png":::

Verify in AD DS

In Active Directory Users and Computers, confirm that the original group is updated in its expected OU rather than a duplicate group being created.

:::image type="content" source="media/tutorial-group-provision/verify.png" alt-text="Screenshot of a provisioned security group in its Active Directory organizational unit." lightbox="media/tutorial-group-provision/verify.png":::

Open the group properties and verify that the expected group name, scope, and attributes are present.

:::image type="content" source="media/tutorial-group-provision/updated-group.png" alt-text="Screenshot of the updated SOA-converted group's general properties in Active Directory." lightbox="media/tutorial-group-provision/updated-group.png":::

:::image type="content" source="media/tutorial-group-provision/group-properties.png" alt-text="Screenshot of the updated SOA-converted group's Attribute Editor showing its distinguished name, cn, and adminDescription values." lightbox="media/tutorial-group-provision/group-properties.png":::

Cloud skips changes made in AD after SOA conversion

After you convert an object's SOA to the cloud, the cloud is the source of authority. If you edit an attribute of that object directly in AD DS (for example, rename a group), Cloud Sync skips the object during provisioning. In Provisioning logs, the object shows as Skipped, and the details explain that the object isn't synced because its SOA is converted to the cloud.

:::image type="content" source="media/tutorial-group-provision/update-group-name.png" alt-text="Screenshot of an SOA-converted group's name being changed directly in Active Directory." lightbox="media/tutorial-group-provision/update-group-name.png":::

:::image type="content" source="media/tutorial-group-provision/skipped.config-5.png" alt-text="Screenshot of the provisioning logs showing the modified SOA-converted group with a Skipped status.on-demand." lightbox="media/tutorial-group-provision/skipped.how-to-configure-entra-to-active-directory/config-5.png":::

:::image type="content" source="media/tutorial-group-provision/sync-blocked.png" alt-text="Screenshot of provisioning log details explainingYou can use this to validate and verify that export was skipped because the group's SOA was convertedchanges made to the cloud." lightbox="media/tutorial-group-provision/sync-blocked.png":::

Move a provisioned userconfiguration were applied properly and are being correctly synchronized to a different organizational unit

Microsoft Entra ID.

After testing, you should see a usermessage telling you what you still need to do to configure cloud sync. You can click the link to continue.

For more information, see on-demand provisioning.

Accidental deletions and email notifications

The default properties section provides information on accidental deletions and email notifications.

The accidental delete feature is provisioned, changing the Target container doesn't move them,designed to protect you from accidental configuration changes and moving the object manually in AD DS is reverted on the next sync cycle. This behavior is expected, because the default parentDistinguishedName expression checks whether the user already has anchanges to your on-premises location:

IIF(IsNullOrEmpty([onPremisesDistinguishedName]), "OU=Cloud_Users,DC=contoso,DC=com", Replace([onPremisesDistinguishedName], , "^.*?,(?=(?:CN|OU|DC)=)", , "", , ))

When onPremisesDistinguishedName is empty, the user is created in the constant target container you specified. When it's populated, the expression derives the OU fromdirectory that attribute insteadwould affect many users and ignores the constant. That precedence preserves the original OU of a user whose SOA is converted to the cloud. It's also why an already-provisioned user keeps returning to the OU recorded on their cloud object.groups.

A cloud-native user has no onPremisesDistinguishedName until the first provisioning cycle, which writes the value back to the cloud object. For the full list of attributes written back, see On-premises attributes written back to Microsoft Entra ID.

:::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/on-premises-distinguished-name-original-organizational-unit.png" alt-text="Screenshot of a user's on-premises properties in Microsoft Entra ID showing the on-premises distinguished name." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/on-premises-distinguished-name-original-organizational-unit.png":::

To move a user, use the option that matches the scope of the change:This feature allows you to:

  • All users that matchConfigure the ability to prevent accidental deletes automatically.
  • Set the # of objects (threshold) beyond which the configuration will take effect
  • Set up a mapping rulenotification email address so they can get an email notification once the sync job in question is put in quarantine for this scenario

For more information, see Accidental deletes

Click the pencil —next to Basics to change the defaults in a configuration.

Enable your configuration

Once you've finalized and tested your configuration, you can enable it.

Click Enable configuration to enable it.

Quarantines

Cloud sync monitors the health of your configuration and places unhealthy objects in a quarantine state. If most or all of the calls made against the target container mapping so it pointssystem consistently fail because of an error, for example, invalid admin credentials, the sync job is marked as in quarantine. For more information, see the troubleshooting section on quarantines.

Restart provisioning

If you don't want to wait for the new OU, thennext scheduled run, trigger the provisioning run by using the Restart sync button. [!INCLUDE sign in] 4. Under Configuration, select your configuration.

  1. At the top, select SaveRestart sync. Provisioning restarts and moves every user that matches

Remove a configuration

To delete a configuration, follow these steps.

[!INCLUDE sign in] 3. Under Configuration, select your configuration.

  1. At the mapping rules on the next cycle.
  2. A single user — update that user's onPremisesDistinguishedName attribute in Microsoft Entra ID.
  3. A user that's moving to a different domain — remove the user from the current configuration's scope, then add the user to the scopetop of the configuration that targets the other domain.

    4. The onPremisesDistinguishedName attribute is read-only unless you're assigned at least the Hybrid Identity Administrator role. The Microsoft Entra admin center doesn't expose on-premises attributes for editing, so use Microsoft Graph to update a single user:

    PATCH https://graph.microsoft.com/v1.0/users/{user-id}
Content-Type: application/json

{
    "onPremisesDistinguishedName": "CN=Cloud User,OU=Cloud_Users,DC=contoso,DC=com"
}

    A 204 No Content response confirms the update. The user moves to the new OU on the next sync cycle.

    :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/graph-update-on-premises-distinguished-name.png" alt-text="Screenshot of a Microsoft Graph PATCH request that updates the on-premises distinguished name and returns 204 No Content." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/graph-update-on-premises-distinguished-name.png":::

    To confirm the move, open the user's entry in Provisioning logs andscreen, select Modified PropertiesDelete configuration. The parentDistinguishedName row shows the old and new values.

    :::image type="content" source="media/how-to-attribute-mapping-entra-to-active-directory/provisioning-log-parent-distinguished-name-updated.png" alt-text="Screenshot of provisioning log details showing the old and new parentDistinguishedName values." lightbox="media/how-to-attribute-mapping-entra-to-active-directory/provisioning-log-parent-distinguished-name-updated.png":::

    Roll back a SOA-converted user or group

    If you roll back a SOA-converted user or group so that AD DS owns it again, provisioning stops syncing changes for that object and removes it from the configuration scope. The on-premises object isn't deleted, and on-premises control resumes in the next sync cycle.

    To confirm a rollback, check the Audit logs to verify that sync no longer happens for the object because it's managed on-premises, then confirm in AD DS that the object is still present.

    Next step

    [!div class="nextstepaction"] Test and enable provisioning

    Related content

Next steps

Daily Entra.News

Get daily email updates

Get a concise summary of the latest Microsoft Entra updates delivered straight to your inbox.

Loading the secure signup form…