How to Configure Group Writeback in Microsoft Entra Cloud Sync

Group writeback enables Microsoft Entra ID security groups synchronization with your on-premises AD. However, Microsoft deprecated security group writeback in Microsoft Entra Connect in June 2024. But they made it available in Microsoft Entra Cloud Sync. In this article, you will learn how to configure group writeback in Microsoft Entra Cloud Sync.

Prerequisites for Microsoft Entra Cloud Sync

Before proceeding, make sure you have:

• A Microsoft Entra ID tenant.
• An Entra ID Global Administrator account for initial setup.
• At least one Windows Server 2016 or later machine (domain-joined) to host the provisioning agent.
• Necessary firewall ports open: HTTPS (443) and HTTP (80) to Microsoft cloud endpoints.
• Proper DNS resolution from the server to your domain controllers and to external internet.

If you already followed the article Enable Group Writeback in Microsoft Entra Connect Sync, you already have the OUs set up and it’s writing back the groups from Entra ID to AD. However, these are not the security groups.

How to enable group writeback in Microsoft Entra Cloud Sync

To enable and configure group writeback in Microsoft Entra Cloud Sync, follow the steps below:

Step 1. Create OUs in AD

Start Active Directory Users and Computers and create two separate OUs:

• Entra ID: Microsoft Entra ID
• AD: Active Directory

If you already have different OUs for the groups, you don’t have to create an AD OU and move all the groups into it. Only create a new OU named Entra ID. This is what you will use later in the guide.

1. Right-click the Entra ID OU
2. Click Properties

3. Double-click on the distinguishedName attribute

4. Copy the value and save it. You will need it later in the guide.

Step 2. Get group writeback status

If you have Microsoft Entra Connect installed, run the Get-ADSyncAADCompanyFeature PowerShell cmdlet to check the group writeback status.

Get-ADSyncAADCompanyFeature

The PowerShell output shows that UnifiedGroupWriteback is disabled because the value is False.

PasswordHashSync           : True
ForcePasswordChangeOnLogOn : False
UserWriteback              : False
DeviceWriteback            : False
UnifiedGroupWriteback      : False
GroupWritebackV2           : False

You can have the UnifiedGroupWriteback enabled and keep it like that. It’s important that you have GroupWritebackV2 disabled because that’s discontinued. Read more in the article Disable Group Writeback v2 in Microsoft Entra Connect.

Step 3. Download the Cloud Sync Agent

1. Sign in to the Microsoft Entra admin center
2. Navigate to Identity > Show more

3. Select Hybrid management > Microsoft Entra Connect
4. Click on Cloud Sync

5. Select Agents
6. Click on Download on-premises agent

7. Click on Accept terms & download
8. Save the executable file to your Windows Server machine

Step 4. Install Provisioning Agent on Windows Server

1. Start File Explorer
2. Go to the downloaded Provisioning Agent setup executable file
3. Run the downloaded Microsoft Entra Connect Provisioning Agent installer as Administrator

4. Accept the license terms and conditions
5. Click Install

6. The setup starts installing the Microsoft Entra Provisioning Agent

7. Click Next in the Welcome to the Microsoft Entra provisioning agent configuration wizard screen

8. Select HR-driven provisioning (Workday and SuccessFactors) / Microsoft Entra Cloud Sync
9. Click Next

10. Click Authenticate
11. Sign in with your Microsoft Entra ID administrator credentials

12. Select Create gSMA
13. Enter your On-Premises domain admin credentials
14. Click Next

15. Click Next

16. Click Confirm

17. Click Exit

Step 5. Verify Provisioning Agent status

1. Sign in to the Microsoft Entra admin center
2. Click Agents and verify that the machine name appears and the status is Active

3. Start Windows Services
4. Verify that the Microsoft Azure AD Connect Provisioning Agent service is running

5. Start Active Directory Users and Computers
6. Navigate to Domain (exoip.local) > Managed Service Accounts
7. Verify that the provAgentgMSA service account appears

Step 6. Set up Microsoft Entra ID to AD sync configuration

1. Sign in to Microsoft Entra admin center
2. Click on Configurations
3. Select + New configuration > Microsoft Entra ID to AD sync

4. Select the Active Directory domain
5. Click Create

6. Click Overview
7. Select Properties
8. Click on the pencil icon to edit the Basics

9. Configure the basics:

• Add email address for notifications
• Enable prevent accidental deletion
• Set accidental deletion treshold to 500

10. Select Apply

11. Click Scoping filters
12. Select All security groups
13. Select Edit attribute mapping

14. Select Constant from the dropdown menu
15. Paste in the Constant value field the OU distinguished name value that you noted in the first step
16. Click Apply

17. Click Save

18. Click Overview
19. Click Review and enable

20. Click Enable configuration

Step 7. Check Microsoft Entra ID to AD sync configuration status

1. Verify that the configuration sync from Microsoft Entra ID to AD shows the status Healthy

2. Return to Overview
3. Select Overview and verify that everything looks good

Step 8. Verify group writeback sync

1. Select Monitoring
2. Group provision shows initial sync not run

3. Refresh until it shows the initial sync completed

4. Verify that the security groups are written back to the Entra ID OU

5. Suppose you want to double-check that these are the security groups, you can always sign in to the Microsoft Entra admin center and go the Groups blade and filter them in Microsoft Entra ID on:

• Group type: Security
• Source: Cloud

These are the correct groups that are written back from Microsoft Entra ID to on-premises AD.

That’s it!

Read more: Configure Microsoft Entra Password Protection for on-premises »

Conclusion

You learned how to configure group writeback in Microsoft Entra Cloud Sync. This applies only to cloud security groups. If you want the distribution groups and Microsoft 365 groups writeback, Enable group writeback in Microsoft Entra Connect Sync. This way you have all the groups written back from Entra ID to on-premises AD.

Did you enjoy this article? You may also like How to Restrict access to Microsoft Entra admin center. Don’t forget to follow us and share this article.