Microsoft Entra ID
FundamentalsProvision Entra Id To Active Directory
In brief
The documentation now states that password writeback isn't supported for applications that collect passwords, including applications that authenticate users through an LDAP bind.
What Entra admins need to know
Administrators should review applications that depend on AD DS passwords or LDAP binds when planning authentication for cloud-managed users.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Provisioning custom security attributes (CSA) to AD.
- Provisioning Exchange attributes to AD. Because user SOA is in the cloud, Exchange-related information isn't needed in AD. For managing Exchange recipients without an on-premises Exchange Server, see Decommission the last Exchange Server after transferring SOA to cloud and Manage recipients in Exchange hybrid environments using management tools.
- Mail-enabled groups and distribution groups. Only security groups are supported.
- Password writeback, which
password-based apps, including appsapplications thatauthentiatecollect a user's password need, isn't supported. This includes applications that authenticate usersvia LDAP, need.by performing an LDAP bind with the user's password. Cloud-managed users have no AD DS password to present, sothe apps must be updated to Kerberos so those users canuse passwordless authentication forKerberos-basedapplications that support Kerberos instead. For more information, see How cloud-managed users sign in to the application. - Complex multi-domain hybrid identity architectures. Provisioning to AD is designed for single-domain identity continuity.
License requirements
@@ -92,7 +92,7 @@ The following scenarios aren't supported: - Provisioning **custom security attributes (CSA)** to AD. - Provisioning **Exchange attributes** to AD. Because user SOA is in the cloud, Exchange-related information isn't needed in AD. For managing Exchange recipients without an on-premises Exchange Server, see [Decommission the last Exchange Server after transferring SOA to cloud](/exchange/hybrid-deployment/decommission-last-exchange-server) and [Manage recipients in Exchange hybrid environments using management tools](/exchange/manage-hybrid-exchange-recipients-with-management-tools). - **Mail-enabled groups and distribution groups.** Only security groups are supported.-- **Password writeback**, which password-based apps, including apps that authentiate users via LDAP, need. Cloud-managed users have no AD DS password to present, so the apps must be updated to Kerberos so those users can use passwordless authentication for Kerberos-based applications instead. For more information, see [How cloud-managed users sign in to the application](tutorial-users-groups-provisioning-walkthrough.md#how-cloud-managed-users-sign-in-to-the-application).+- **Password writeback**, which applications that collect a user's password need, isn't supported. This includes applications that authenticate users by performing an LDAP bind with the user's password. Cloud-managed users have no AD DS password to present, so use passwordless authentication for applications that support Kerberos instead. For more information, see [How cloud-managed users sign in to the application](tutorial-users-groups-provisioning-walkthrough.md#how-cloud-managed-users-sign-in-to-the-application). - Complex **multi-domain hybrid identity architectures**. Provisioning to AD is designed for single-domain identity continuity. ## License requirements