Microsoft Entra ID
ProvisioningMicrosoft Entra Cloud Sync directory extensions for provisioning to Active Directory
In brief
The article was retitled and updated to focus on provisioning directory extensions to Active Directory with Cloud Sync, including group schema, scoping, and attribute mapping. Links now point to updated Cloud Sync resources and a group-provisioning scenario.
What Entra admins need to know
Administrators should use the updated references when following this guidance. The documented application identifier URI and Tenant Schema Extension App requirement remain included.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Directory extensions for provisioning Microsoft Entra ID to Active Directory
You can use directory extensions to extend the schema of users and groups,your groups and then use thosethese attributes for scoping and attribute mapping. If you're looking for directory extensions when provisioning from Active Directory to Microsoft Entra ID, seeYou can use the same steps that are outlined in the cloud sync directory extensions and custom attributes. doc.
For a step-by-step examples of extendingtutorial on how to extend the schema and then usinguse the directory extension attributesattribute with cloud sync provisioning to Active Directory,AD, see Scenario - Using directory extensions with group provisioning to Active Directory. That article covers both users and groups.
Ways to create directory extensions
You can create directory extensions in Microsoft Entra ID in several different ways. The following table provides links and additional information.
| Method | Description | URL |
|---|---|---|
| Create extensions using |
Create extensionProperty | |
| PowerShell | Create extensions using PowerShell | New-MgApplicationExtensionProperty |
| Using cloud sync and Microsoft Entra Connect | Create extensions using Microsoft Entra Connect | Create an extension attribute using Microsoft Entra Connect |
Next step
[!div class="nextstepaction"] Use directory extensions when provisioning to Active Directory
Related contentAdditional resources
@@ -1,44 +1,32 @@ ----title: 'Microsoft Entra directory extensions for provisioning to AD'-description: Learn how directory extensions for users and groups support provisioning from Microsoft Entra ID to Active Directory.-author: dhanyahk-ms.author: dhanyahk-ms.service: entra-id-ms.custom: has-azure-ad-ps-ref, azure-ad-ref-level-one-done, msecd-doc-authoring-1023+title: 'Microsoft Entra Cloud Sync directory extensions for provisioning to Active Directory'+description: This article provides information on directory extensions for provisioning to Active Directory with cloud sync.+ms.custom: has-azure-ad-ps-ref, azure-ad-ref-level-one-done ms.topic: concept-article-ms.date: 08/11/2026+ms.date: 04/09/2025 ms.subservice: hybrid-cloud-sync-ai-usage: ai-assisted-#customer intent: As a hybrid identity administrator, I want to understand directory extensions so that I can use them when provisioning users and groups to Active Directory. --- # Directory extensions for provisioning Microsoft Entra ID to Active Directory+You can use directory extensions to extend the schema of your groups and then use these attributes for scoping and attribute mapping. You can use the same steps that are outlined in the [cloud sync directory extensions and custom attributes](custom-attribute-mapping.md) doc. -You can use directory extensions to extend the schema of users and groups, and then use those attributes for scoping and attribute mapping. If you're looking for directory extensions when provisioning from Active Directory to Microsoft Entra ID, see [Cloud sync directory extensions and custom attribute mapping](custom-attribute-mapping.md).+>[!Important]+> Directory extension for Microsoft Entra Cloud Sync is only supported for applications with the identifier URI "api://<tenantId>/CloudSyncCustomExtensionsApp" and the [Tenant Schema Extension App](../connect/how-to-connect-sync-feature-directory-extensions.md#configuration-changes-in-azure-ad-made-by-the-wizard) created by Microsoft Entra Connect -> [!IMPORTANT]-> Directory extensions for Microsoft Entra Cloud Sync are supported only for applications with the identifier URI `api://<tenantId>/CloudSyncCustomExtensionsApp` and the [Tenant Schema Extension App](../connect/how-to-connect-sync-feature-directory-extensions.md#configuration-changes-in-azure-ad-made-by-the-wizard) created by Microsoft Entra Connect.--For step-by-step examples of extending the schema and then using directory extension attributes with cloud sync provisioning to Active Directory, see [Use directory extensions when provisioning to Active Directory](tutorial-directory-extension-group-provisioning.md). That article covers both users and groups.+For a step-by-step tutorial on how to extend the schema and then use the directory extension attribute with cloud sync provisioning to AD, see [Scenario - Using directory extensions with group provisioning to Active Directory](tutorial-directory-extension-group-provisioning.md). ## Ways to create directory extensions--You can create directory extensions in Microsoft Entra ID in several different ways. The following table provides links and additional information.+You can create directory extensions in Microsoft Entra ID in several different ways. The following table provides links and additional information. |Method|Description|URL| |-----|-----|-----|-|Microsoft Graph|Create extensions using Microsoft Graph|[Create extensionProperty](/graph/api/application-post-extensionproperty?view=graph-rest-1.0&tabs=http&preserve-view=true)|-|PowerShell|Create extensions using PowerShell|[New-MgApplicationExtensionProperty](/powershell/module/microsoft.graph.applications/new-mgapplicationextensionproperty)|-|Microsoft Entra Connect|Create extensions using Microsoft Entra Connect|[Create an extension attribute using Microsoft Entra Connect](../../app-provisioning/user-provisioning-sync-attributes-for-mapping.md#create-an-extension-attribute-using-azure-ad-connect)|---## Next step+|MS Graph|Create extensions using GRAPH|[Create extensionProperty](/graph/api/application-post-extensionproperty?view=graph-rest-1.0&tabs=http&preserve-view=true)|+|PowerShell|Create extensions using PowerShell|[New-MgApplicationExtensionProperty](/powershell/module/microsoft.graph.applications/new-mgapplicationextensionproperty)| +Using cloud sync and Microsoft Entra Connect|Create extensions using Microsoft Entra Connect|[Create an extension attribute using Microsoft Entra Connect](../../app-provisioning/user-provisioning-sync-attributes-for-mapping.md#create-an-extension-attribute-using-azure-ad-connect)| -> [!div class="nextstepaction"]-> [Use directory extensions when provisioning to Active Directory](tutorial-directory-extension-group-provisioning.md) -## Related content+## Additional resources - [Microsoft Entra schema and custom expressions](concept-attributes.md) - [Microsoft Entra Connect Sync: Directory extensions](../connect/how-to-connect-sync-feature-directory-extensions.md)-- [Scoping filter and attribute mapping - Microsoft Entra ID to Active Directory](how-to-attribute-mapping-entra-to-active-directory.md)+- [Attribute mapping in Microsoft Entra Cloud Sync](how-to-attribute-mapping.md)