Monday, 31 August 2026

The article was rewritten for provisioning groups from Microsoft Entra ID to Active Directory, adding updated setup steps, screenshots, and sections for scoping, attribute mapping, testing, and default settings. Previous combined users-and-groups guidance was removed, and a deprecation notice was added.

The documentation now states that cloud-synced groups can contain only on-premises synchronized users and additional cloud-created security groups, and that all users must have `onPremisesObjectIdentifier`. The example link and diagram descriptions were also updated.

The article now describes extending a group schema attribute and using it to filter groups provisioned to Active Directory. It replaces the previous combined users-and-groups examples with a group-focused scenario and setup instructions.

A new tutorial explains how to configure Microsoft Entra Cloud Sync to provision groups to on-premises AD DS. It covers Entra-to-AD and AD-to-Entra scenarios, including how source of authority and membership affect provisioning.

The 246-line tutorial for provisioning cloud-managed users and groups to Active Directory with Microsoft Entra Cloud Sync was deleted. It covered preview user provisioning for access to an on-premises Kerberos application.

The article now documents selecting a group and up to five members for testing. User-specific instructions and result-review details were removed, and provisioning-direction references were updated.

The article was retitled and updated to focus on provisioning directory extensions to Active Directory with Cloud Sync, including group schema, scoping, and attribute mapping. Links now point to updated Cloud Sync resources and a group-provisioning scenario.

The article’s introduction now describes on-demand provisioning from Microsoft Entra ID to Active Directory and links to related guidance.

The article explaining how Microsoft Entra Cloud Sync provisions users, groups, and memberships to Active Directory was deleted.

The article covering prerequisites and license requirements for provisioning users and groups from Microsoft Entra ID to on-premises Active Directory with Cloud Sync was deleted, along with its related links and next-step guidance.

The how-to page for testing and enabling Microsoft Entra ID to Active Directory provisioning was deleted, including guidance on on-demand tests, default properties, enabling configurations, quarantines, restarting sync, and removing configurations.

The guidance now links to the group provisioning tutorial and its updated section on nested groups and membership references.

The article comparing group-only, user-only, and users-and-groups provisioning from Microsoft Entra ID to Active Directory was deleted, including guidance on scoping, configuration limits, and performance.

The documentation page describing Microsoft Entra Cloud Sync provisioning of users, groups, and memberships from Entra ID to Active Directory was deleted.

The article describing the preview GroupDN setup for preserving a group’s organizational unit and name during Source of Authority conversion was deleted.

The documentation now points administrators to the Microsoft Entra Cloud Sync tutorial for provisioning groups to Active Directory Domain Services, replacing the previous provisioning overview and on-premises app governance links.

The Access guidance now points to an updated Microsoft Entra Cloud Sync documentation link for provisioning groups to Active Directory.

The documentation now provides step-by-step My Access portal instructions for authorized users to request an access package for another user, including the US Government portal URL.

The documentation now links to the Microsoft Entra Cloud Sync group provisioning tutorial instead of the configuration guide.

The guidance for recreating AD DS groups as cloud security groups, provisioning them as Universal groups, and updating applications to use their new security identifiers was revised.

The documentation now uses a new screenshot showing configuration of an access package’s request-on-behalf-of policy.

New documentation describes adding custom HTTP headers to matching outbound web requests through Web Content Filtering v2 rules. The capability is currently in preview and supports tenant restrictions and other header-aware services.