Scenario - Using directory extensions with group provisioning to Active Directory

Scenario: You have hundreds of groups in Microsoft Entra ID. You want to provision some of these groups but not all back to Active Directory. You would like a quick filter that can be applied to groups without having to make a more complicated scoping filter.

You can use the environment you create in this scenario for testing or for getting more familiar with cloud sync.

Assumptions

• This scenario assumes that you already have a working environment that is synchronizing users to Microsoft Entra ID.
• We have 4 users that are synchronized. Britta Simon, Lola Jacobson, Anna Ringdahl, and John Smith.
• Three organizational Units have been created in Active Directory - Sales, Marketing, and Groups
• The Britta Simon and Anna Ringdahl user accounts reside in the Sales OU.
• The Lola Jacobson and John Smith user accounts reside in the Marketing OU.
• The Groups OU is where our groups from Microsoft Entra ID are provisioned.

Create two groups in Microsoft Entra ID

To begin, create two groups in Microsoft Entra ID. One group is Sales and the Other is Marketing.

To create two groups, follow these steps.

1. Sign in to the Microsoft Entra admin center as at least a Hybrid Identity Administrator.
2. Browse to Identity > Groups > All groups.
3. At the top, click New group.
4. Make sure the Group type is set to security.
5. For the Group Name enter Sales
6. For Membership type keep it at assigned.
7. Click Create.
8. Repeat this process using Marketing as the Group Name.

Add users to the newly created groups

1. Sign in to the Microsoft Entra admin center as at least a Hybrid Identity Administrator.
2. Browse to Identity > Groups > All groups.
3. At the top, in the search box, enter Sales.
4. Click on the new Sales group.
5. On the left, click Members
6. At the top, click Add members.
7. At the top, in the search box, enter Britta Simon.
8. Put a check next to Britta Simon and Anna Ringdahl and click Select
9. It should successfully add her to the group.
10. On the far left, click All groups and repeat this process using the Marketing group and adding Lola Jacobson and John Smith to that group.

Install and connect Microsoft Graph PowerShell SDK

1. If not yet installed, follow Microsoft Graph PowerShell SDK documentation to install the main modules of Microsoft Graph PowerShell SDK: Microsoft.Graph.

2. Open PowerShell with Administrative privileges

3. To set the execution policy, run (press [A] Yes to all when prompted):

   Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
   

4. Connect to your tenant (Be sure to accept on-behalf of when signing in):

   Connect-MgGraph -Scopes "Directory.ReadWrite.All", "Application.ReadWrite.All", "User.ReadWrite.All, Group.ReadWrite.All"
   

Create our CloudSyncCustomExtensionApp application and service principal

1. Get the Tenant ID:

   $tenantId = (Get-MgOrganization).Id
   $tenantId
   

1. Using the $tenantId variable from the previous step, check to see if the CloudSyncCustomExtensionApp exists.

   $cloudSyncCustomExtApp = Get-MgApplication -Filter "identifierUris/any(uri:uri eq 'api://$tenantId/CloudSyncCustomExtensionsApp')"
   $cloudSyncCustomExtApp
   

2. If a CloudSyncCustomExtensionApp exists, skip to the next step. Otherwise, create the new CloudSyncCustomExtensionApp app:

   $cloudSyncCustomExtApp = New-MgApplication -DisplayName "CloudSyncCustomExtensionsApp" -IdentifierUris "api://$tenantId/CloudSyncCustomExtensionsApp"
   $cloudSyncCustomExtApp 
   

3. Check if CloudSyncCustomExtensionsApp application has a security principal associated. If you just created a new app, skip to the next step.

   Get-MgServicePrincipal -Filter "AppId eq '$($cloudSyncCustomExtApp.AppId)'"
   

4. If you just created a new app or a security principal is not returned, create a security principal for CloudSyncCustomExtensionsApp:

   New-MgServicePrincipal -AppId $cloudSyncCustomExtApp.AppId
   

Create our custom extension attribute

1. Get the Tenant ID:

   $tenantId = (Get-MgOrganization).Id
   $tenantId
   

2. Get the CloudSyncCustomExtensionsApp application:

   $cloudSyncCustomExtApp = Get-MgApplication -Filter "identifierUris/any(uri:uri eq 'api://$tenantId/CloudSyncCustomExtensionsApp')"
   

3. Now, under the CloudSyncCustomExtensionApp, create the custom extension attribute called "WritebackEnabled" and assign it to Group objects:

   New-MgApplicationExtensionProperty -ApplicationId $cloudSyncCustomExtApp.Id -Name 'WritebackEnabled' -DataType 'Boolean' -TargetObjects 'Group'
   

4. This cmdlet creates an extension attribute that looks like extension_<guid>_WritebackEnabled.

Create our cloud sync configuration

1. Sign in to the Microsoft Entra admin center as at least a Hybrid Identity Administrator.

2. Browse to Identity > Hybrid Management > Microsoft Entra Connect > Cloud sync.

3. Select New configuration.

4. Select Microsoft Entra ID to AD sync.

5. On the configuration screen, select your domain and whether to enable password hash sync. Click Create.

6. The Get started screen opens. From here, you can continue configuring cloud sync

7. On the left, click Scoping filters select Group scope - All groups

8. Click Edit attribute mapping and change the Target Container to OU=Groups,DC=Contoso,DC=com. Click Save.

9. Click Add Attribute scoping filter

10. Type a name for the scoping filter: Filter groups with Writeback Enabled

11. Under Target Attribute select the newly created attribute that looks like extension_<guid>_WritebackEnabled.

13. Under Operator select IS TRUE
14. Click Save. And click Save.
15. Leave the configuration disabled and come back to it.

Add new extension property to one of our groups

For this portion, we're going add a value on our newly created property to one of our existing groups, Marketing.

Set the extension property value using Microsoft Graph PowerShell SDK

1. Get the Tenant ID:

   $tenantId = (Get-MgOrganization).Id
   $tenantId
   

2. Get the CloudSyncCustomExtensionsApp application:

   $cloudSyncCustomExtApp = Get-MgApplication -Filter "identifierUris/any(uri:uri eq 'api://$tenantId/CloudSyncCustomExtensionsApp')"
   

3. Get our extension property:

   $gwbEnabledExtAttrib = Get-MgApplicationExtensionProperty -ApplicationId $cloudSyncCustomExtApp.Id | 
       Where-Object {$_.Name -Like '*WritebackEnabled'} | Select-Object -First 1
   $gwbEnabledExtAttrib 
   $gwbEnabledExtName = $gwbEnabledExtAttrib.Name
   

4. Now, get the Marketing group:

   $marketingGrp = Get-MgGroup -ConsistencyLevel eventual -Filter "DisplayName eq 'Marketing'"
   $marketingGrp 
   

5. Then, with the variable $gwbEnabledExtName containing extension_<guid>_WritebackEnabled, set the value True for the Marketing group:

   Update-MgGroup -GroupId $marketingGrp.Id -AdditionalProperties @{$gwbEnabledExtName = $true}
   

6. To confirm, you can read the extension_<guid>_WritebackEnabled property value with:

   $marketingGrp = Get-MgGroup -ConsistencyLevel eventual -Filter "DisplayName eq 'Marketing'" -Property Id,$gwbEnabledExtName
   $marketingGrp.AdditionalProperties.$gwbEnabledExtName
   

Set the extension property value using Microsoft Graph Explorer

You need to make sure that you have consented to Group.ReadWrite.All. You can do this by selecting Modify permissions.

1. Navigate to Microsoft Graph Explorer

2. Sign-in using your tenant administrator account. This may need to be a Hybrid Identity Administrator account. A Hybrid Identity Administrator account was used in creating this scenario. A Hybrid Identity Administrator account may be sufficient.

3. At the top, change the GET to PATCH

4. In the address box enter: https://graph.microsoft.com/v1.0/groups/<Group Id>

5. In the Request body enter:

   {
    extension_<guid>_WritebackEnabled: true
   }
   
   

6. Click Run query

7. If done correctly, you see [].

8. Now at the top, change PATCH to GET and look at the properties of the marketing group.

9. Click Run query. You should see the newly created attribute.

Test our configuration

1. Sign in to the Microsoft Entra admin center as at least a Hybrid Administrator.
2. Browse to Identity > Hybrid management > Microsoft Entra Connect > Cloud sync.

3. Under Configuration, select your configuration.
4. On the left, select Provision on demand.
5. Enter Marketing in the Selected group box
6. From the Selected users section, select some users to test. Select Lola Jacobson and John Smith.
7. Click Provision. It should successfully provision.
8. Now try with the Sales group and add Britta Simon and Anna Ringdahl. This shouldn't provision.
9. In Active Directory, you should see the newly created Marketing group.
10. You can now browse to Identity > Hybrid Management > Microsoft Entra Connect > Cloud sync > Overview page to Review and Enable our configuration to start synchronizing.

Next steps

• Use Group writeback with Microsoft Entra Cloud Sync

• Govern on-premises Active Directory based apps (Kerberos) using Microsoft Entra ID Governance

• Migrate Microsoft Entra Connect Sync group writeback V2 to Microsoft Entra Cloud Sync