انتقل إلى المحتوى الرئيسي

Change provisioning flow of existing groups to Microsoft Entra ID

Overview​

Change the source of authority (SOA) for eligible groups synchronized from on-premises Active Directory Domain Services (AD DS) to Microsoft Entra ID. Once a group's SOA is changed, manage it directly in the cloud instead of in AD DS. This supports AD DS minimization and a cloud-first identity strategy.

Before changing a group's SOA, review the Group SOA guidance and confirm the group and dependent workloads meet the documented requirements. If a group must remain available in AD DS, configure security group provisioning from Microsoft Entra ID to AD DS so that cloud-side changes are reflected on-premises.

Remediation​

  1. Review the Group SOA overview and guidance, including supported scenarios and prerequisites.
  2. Follow the configuration procedure to change the SOA of eligible groups to Microsoft Entra ID.
  3. For groups still required in AD DS, configure provisioning from Microsoft Entra ID to AD DS and validate that group changes are reflected as expected.

Reference​