Staged Rollout with Password Hash Sync & Its not working consistently for all users

Durgesh Mishra 60 Reputation points
2026-05-26T16:33:34.5066667+00:00

We are testing migration from ADFS to Password Hash Sync using Entra ID Staged Rollout. A synced AD security group is added for staged rollout and users are direct members of the group. Issue is that some users correctly become "Managed" and go to Entra login + Duo MFA, while other users in the same group still remain "Federated" and continue redirecting to ADFS.
We validated: - Group is Assigned (not Dynamic) - No nested groups - Users synced correctly from on-prem AD - Password Hash Sync enabled - Group membership synced properly Behavior seems inconsistent and sometimes changes only after long propagation delays.
Need help understanding why staged rollout is not applying consistently to all users in the same synced group.

and also after removing that group from stagged rollout one user is still showing managed.

Azure
Azure

A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.

0 comments
Answer accepted by question author
Amira Bedhiafi 43,046 Reputation points MVP Volunteer Moderator
2026-05-27T07:40:46.3533333+00:00

Hello Durgesh !

Thank you for posting on MS Learn Q&A.

This behavior can happen with Entra ID Staged Rollout and is usually related to propagation.

Even when the group is synced and users are direct members changes to a Staged Rollout group can take up to 24 hours to take effect. It is better using cloud security groups for staged rollout where possible to avoid onprem AD group sync latency.

When a user is added to a Staged Rollout group, the transition from federated to managed authentication may complete after the user performs another interactive signin. Similarly, when a user is removed from the Staged Rollout group, they may continue to use managed authentication until they complete another interactive signin after which federation is applied again.

Staged Rollout applies to browser and modern authentication scenarios. Some flows can still use federation, for example:

  • legacy authentication clients
  • apps sending a domain_hint
  • certain Windows/PRT scenarios
  • devices using cached sessions

So it is possible for the same user to appear as managed in one test and still redirect to AD FS in another app/client scenario.

You can test with an inprivate browser session and go directly to:

https://myapps.microsoft.com

Enter the user UPN manually then check the Microsoft Entra sign-in logs for that user to confirm whether the authentication path is federated or cloud-managed.

Was this answer helpful?

2 people found this answer helpful.
0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.