Microsoft Entra ID
ProvisioningSynchronization
In brief
The synchronization documentation now describes enhanced support for synchronizing sAMAccountName with Microsoft Entra Domain Services and links to dedicated guidance.
What Entra admins need to know
Administrators can review the linked guidance when evaluating sAMAccountName synchronization.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
:::image type="content" border="true" source="./media/scoped-synchronization/filter.png" alt-text="Screenshot of group filter option.":::
Attribute synchronization and mapping to Domain Services
The following table lists some common attributes and how they're synchronized to Domain Services. | Primary user/group SID | Autogenerated | The primary SID for user/group accounts is autogenerated in Domain Services. This attribute doesn't match the primary user/group SID of the object in an on-premises AD DS environment. This mismatch is because the managed domain has a different SID namespace than the on-premises AD DS domain. | | SID history for users and groups | On-premises primary user and group SID | The SidHistory attribute for users and groups in Domain Services is set to match the corresponding primary user or group SID in an on-premises AD DS environment. This feature helps make lift-and-shift of on-premises applications to Domain Services easier as you don't need to re-ACL resources. |
@@ -34,8 +34,6 @@ You can scope synchronization to only user accounts that originated in the cloud :::image type="content" border="true" source="./media/scoped-synchronization/filter.png" alt-text="Screenshot of group filter option."::: -<a name='attribute-synchronization-and-mapping-to-azure-ad-ds'></a>- ## Attribute synchronization and mapping to Domain Services The following table lists some common attributes and how they're synchronized to Domain Services.@@ -48,6 +46,9 @@ The following table lists some common attributes and how they're synchronized to | Primary user/group SID | Autogenerated | The primary SID for user/group accounts is autogenerated in Domain Services. This attribute doesn't match the primary user/group SID of the object in an on-premises AD DS environment. This mismatch is because the managed domain has a different SID namespace than the on-premises AD DS domain. | | SID history for users and groups | On-premises primary user and group SID | The *SidHistory* attribute for users and groups in Domain Services is set to match the corresponding primary user or group SID in an on-premises AD DS environment. This feature helps make lift-and-shift of on-premises applications to Domain Services easier as you don't need to re-ACL resources. | +> [!NOTE]+> Enhanced support for synchronizing the Security Account Manager account name (sAMAccountName) with Microsoft Entra Domain Services is now in [Public Preview](/entra/identity/domain-services/sam-account-name/sam-account-name).+ > [!TIP] > **Sign in to the managed domain using the UPN format** The *SAMAccountName* attribute, such as `AADDSCONTOSO\driley`, may be auto-generated for some user accounts in a managed domain. Users' auto-generated *SAMAccountName* may differ from their UPN prefix, so isn't always a reliable way to sign in. >