Change provisioning flow of existing groups to Microsoft Entra ID

Overview

Change the source of authority (SOA) for eligible groups synchronized from on-premises Active Directory Domain Services (AD DS) to Microsoft Entra ID. Once a group's SOA is changed, manage it directly in the cloud instead of in AD DS. This supports AD DS minimization and a cloud-first identity strategy.

Before changing a group's SOA, review the Group SOA guidance and confirm the group and dependent workloads meet the documented requirements. If a group must remain available in AD DS, configure security group provisioning from Microsoft Entra ID to AD DS so that cloud-side changes are reflected on-premises.

Remediation

1. Review the Group SOA overview and guidance, including supported scenarios and prerequisites.
2. Follow the configuration procedure to change the SOA of eligible groups to Microsoft Entra ID.
3. For groups still required in AD DS, configure provisioning from Microsoft Entra ID to AD DS and validate that group changes are reflected as expected.

Reference

• Group source of authority overview - Microsoft Entra ID | Microsoft Learn
• Group source of authority guidance - Microsoft Entra ID | Microsoft Learn
• Configure group source of authority - Microsoft Entra ID | Microsoft Learn
• Microsoft Entra cloud-first identity guidance