Microsoft Entra ID

Ad Group Enforcement

27 June 2026Updated+0 / −2 lines

In brief

.\Set-CloudSyncSOAPolicy.ps1 -EnforcementMode Audit -Credential (Get-Credential -Message "Enter Domain Admin credentials (format: DOMAIN\Username)")

What Entra admins need to know

Review the documentation change to determine whether it affects tenant configuration, security posture, or rollout plans.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

Open on Microsoft Learn ↗

The comparison below is an extract of the Microsoft Learn article showing only the changed content. Open the full article for complete context.

.\Set-CloudSyncSOAPolicy.ps1 -EnforcementMode Audit -Credential (Get-Credential -Message "Enter Domain Admin credentials (format: DOMAIN\Username)")


<!-- TODO PM: Confirm whether re-running the script is the supported way to switch modes, or whether a different parameter or procedure applies. -->
## Add a break-glass account

You can add the SID of an additional authorized user to the policy so that the user can make changes to enforced groups on-premises.

@@ -123,8 +123,6 @@ To change the mode, run `Set-CloudSyncSOAPolicy.ps1` again with the new value fo .\Set-CloudSyncSOAPolicy.ps1 -EnforcementMode Audit -Credential (Get-Credential -Message "Enter Domain Admin credentials (format: DOMAIN\Username)") ``` -<!-- TODO PM: Confirm whether re-running the script is the supported way to switch modes, or whether a different parameter or procedure applies. -->- ## Add a break-glass account  You can add the SID of an additional authorized user to the policy so that the user can make changes to enforced groups on-premises.