Daily.Entra.NewsThe week’s Entra changes are chiefly a reorganization of Microsoft Entra Cloud Sync guidance around group provisioning to AD DS. A new tutorial and rewritten setup articles separate group workflows from older users-and-groups material; the planning page now documents which members and identifiers cloud-synced groups require, while on-demand testing guidance tells administrators to select a group and up to five members. Seven older pages were removed, including references for prerequisites, general provisioning behavior, and test-and-enable operations.
Entra ID · ProvisioningThe new tutorial covers Entra-to-AD and AD-to-Entra scenarios and explains how source of authority and membership affect provisioning. It recommends Selected security groups as the default scoping filter to help prevent performance issues.
Entra ID · ProvisioningThe guidance states that cloud-synced groups can contain only on-premises synchronized users and additional cloud-created security groups, and that all users must have `onPremisesObjectIdentifier`. The example link and diagram descriptions were also updated.
Entra ID · ProvisioningThe revised procedure tells administrators to select a group and up to five members for testing. User-specific instructions and result-review details were removed, and provisioning-direction references now point to Microsoft Entra ID-to-Active Directory guidance.
Entra ID · ProvisioningThe configure article was rewritten with setup steps, screenshots, scoping, attribute mapping, testing, and default settings for provisioning groups from Microsoft Entra ID to Active Directory. It removes the previous combined users-and-groups guidance and adds a deprecation notice.
Entra ID · ProvisioningThe how-to page for testing and enabling Microsoft Entra ID-to-Active Directory provisioning was removed, including guidance on on-demand tests, default properties, enabling configurations, quarantines, restarting synchronization, and removing configurations.
Review group-provisioning designs and runbooks against the updated membership conditions and group-focused setup. For on-demand tests, select group members manually, up to five. Teams relying on deleted prerequisite or test-and-enable pages will need current Cloud Sync references; the supplied updates state no mandatory configuration change.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The article was rewritten for provisioning groups from Microsoft Entra ID to Active Directory, adding updated setup steps, screenshots, and sections for scoping, attribute mapping, testing, and default settings. Previous combined users-and-groups guidance was removed, and a deprecation notice was added.
The documentation now states that cloud-synced groups can contain only on-premises synchronized users and additional cloud-created security groups, and that all users must have `onPremisesObjectIdentifier`. The example link and diagram descriptions were also updated.
The article now describes extending a group schema attribute and using it to filter groups provisioned to Active Directory. It replaces the previous combined users-and-groups examples with a group-focused scenario and setup instructions.
A new tutorial explains how to configure Microsoft Entra Cloud Sync to provision groups to on-premises AD DS. It covers Entra-to-AD and AD-to-Entra scenarios, including how source of authority and membership affect provisioning.
The 246-line tutorial for provisioning cloud-managed users and groups to Active Directory with Microsoft Entra Cloud Sync was deleted. It covered preview user provisioning for access to an on-premises Kerberos application.
The article now documents selecting a group and up to five members for testing. User-specific instructions and result-review details were removed, and provisioning-direction references were updated.
The article was retitled and updated to focus on provisioning directory extensions to Active Directory with Cloud Sync, including group schema, scoping, and attribute mapping. Links now point to updated Cloud Sync resources and a group-provisioning scenario.
The article’s introduction now describes on-demand provisioning from Microsoft Entra ID to Active Directory and links to related guidance.
The article explaining how Microsoft Entra Cloud Sync provisions users, groups, and memberships to Active Directory was deleted.
The article covering prerequisites and license requirements for provisioning users and groups from Microsoft Entra ID to on-premises Active Directory with Cloud Sync was deleted, along with its related links and next-step guidance.
The how-to page for testing and enabling Microsoft Entra ID to Active Directory provisioning was deleted, including guidance on on-demand tests, default properties, enabling configurations, quarantines, restarting sync, and removing configurations.
The guidance now links to the group provisioning tutorial and its updated section on nested groups and membership references.
The article comparing group-only, user-only, and users-and-groups provisioning from Microsoft Entra ID to Active Directory was deleted, including guidance on scoping, configuration limits, and performance.
The documentation page describing Microsoft Entra Cloud Sync provisioning of users, groups, and memberships from Entra ID to Active Directory was deleted.
The article describing the preview GroupDN setup for preserving a group’s organizational unit and name during Source of Authority conversion was deleted.
The documentation now points administrators to the Microsoft Entra Cloud Sync tutorial for provisioning groups to Active Directory Domain Services, replacing the previous provisioning overview and on-premises app governance links.
The Access guidance now points to an updated Microsoft Entra Cloud Sync documentation link for provisioning groups to Active Directory.
The documentation now links to the Microsoft Entra Cloud Sync group provisioning tutorial instead of the configuration guide.
The guidance for recreating AD DS groups as cloud security groups, provisioning them as Universal groups, and updating applications to use their new security identifiers was revised.
