Microsoft Entra ID

User Source Of Authority Configure

3 November 2026Doc updateAction required+11 / −3 lines

In brief

The documentation now lists Graph PowerShell commands for setting and reading user SOA, identifies the Hybrid Administrator role, and documents cloud-specific connection environments. It also notes that Graph Explorer isn't supported in Azure China.

What Entra admins need to know

Administrators in Azure China must use Graph PowerShell; administrators in other sovereign clouds should select the corresponding documented environment.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.


1. Verify that the user appears in the Microsoft Entra admin center as a synced user.
1. Use Microsoft Graph API to transfer the SOA of the user object (*isCloudManaged*=true). Open [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) and sign in as a [Hybrid Administrator](/entra/identity/role-based-access-control/permissions-reference#hybrid-administrator). Alternatively, use Microsoft Graph PowerShell to perform the following operations with an appropriate user role, suchthe cmdlets linked in [Related content](#related-content).

Let's check the existing SOA status. We didn’t update the SOA yet, so the ~~*isCloudManaged*~~isCloudManaged attribute value should be false. Replace the *{{ID}* in the following examples with the object ID of your user. For more information about this API, see ~~[Get onPremisesSyncBehavior](/graph/api/onpremisessyncbehavior-get)~~Get onPremisesSyncBehavior. /graph/api/onpremisessyncbehavior-update ~~- [How~~

Documentation	Purpose
Update-MgUserOnPremiseSyncBehavior	Sets `IsCloudManaged` to ~~audit~~transfer user SOA.
Get-MgUserOnPremiseSyncBehavior	Reads the user's SOA state.
Microsoft Graph PowerShell cloud authentication	Documents the `USGov`, `USGovDoD`, and ~~monitor User Source of Authority (SOA) in Microsoft Entra ID](user-source-of-authority-audit-monitor.md) - [Configure Group Source of Authority (SOA)](how-to-group-source-of-authority-configure.md)~~ `China` environments.

@@ -3,7 +3,7 @@ title: Configure user Source of Authority (SOA) in Microsoft Entra ID description: Learn how to transfer user management from Active Directory Domain Services (AD DS) to Microsoft Entra ID by using user Source of Authority (SOA). ms.subservice: hybrid-cloud-sync ms.topic: how-to #Required; leave this attribute/value as-is-ms.date: 04/15/2026+ms.date: 10/31/2026 ms.reviewer: dhanyahk ai-usage: ai-assisted @@ -98,7 +98,11 @@ Follow these steps to transfer the SOA for a test user:    ```  1. Verify that the user appears in the Microsoft Entra admin center as a synced user.-1. Use Microsoft Graph API to transfer the SOA of the user object (*isCloudManaged*=true). Open [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) and sign in with an appropriate user role, such as user admin.+1. Use Microsoft Graph API to transfer the SOA of the user object (*isCloudManaged*=true). Open [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) and sign in as a [Hybrid Administrator](/entra/identity/role-based-access-control/permissions-reference#hybrid-administrator). Alternatively, use Microsoft Graph PowerShell to perform the following operations with the cmdlets linked in [Related content](#related-content).++   > [!NOTE]+   > Microsoft Graph Explorer isn't supported in Azure China. Use Microsoft Graph PowerShell instead, and connect with `Connect-MgGraph -Environment China` and the permissions listed in [Prerequisites](#prerequisites). For other sovereign clouds, use `-Environment USGov` or `-Environment USGovDoD` as appropriate. See [Microsoft Graph PowerShell cloud authentication](/powershell/microsoftgraph/authentication-commands#use-get-mgenvironment). The following HTTP examples aren't PowerShell commands.+ 1. Let's check the existing SOA status. We didn’t update the SOA yet, so the *isCloudManaged* attribute value should be false. Replace the *{ID}* in the following examples with the object ID of your user. For more information about this API, see [Get onPremisesSyncBehavior](/graph/api/onpremisessyncbehavior-get). /graph/api/onpremisessyncbehavior-update @@ -333,4 +337,8 @@ To update the cloud-managed contact, you can make the following API call: - [How to audit and monitor User Source of Authority (SOA) in Microsoft Entra ID](user-source-of-authority-audit-monitor.md) - [Configure Group Source of Authority (SOA)](how-to-group-source-of-authority-configure.md) -+| Documentation | Purpose |+| --- | --- |+| [Update-MgUserOnPremiseSyncBehavior](/powershell/module/microsoft.graph.users/update-mguseronpremisesyncbehavior?view=graph-powershell-1.0) | Sets `IsCloudManaged` to transfer user SOA. |+| [Get-MgUserOnPremiseSyncBehavior](/powershell/module/microsoft.graph.users/get-mguseronpremisesyncbehavior?view=graph-powershell-1.0) | Reads the user's SOA state. |+| [Microsoft Graph PowerShell cloud authentication](/powershell/microsoftgraph/authentication-commands#use-get-mgenvironment) | Documents the `USGov`, `USGovDoD`, and `China` environments. |