On-demand provisioning - Microsoft Entra ID to Active Directory

Microsoft Entra Connect cloud sync allows you to test configuration changes, by applying these changes to a group.

You can use this test to validate and verify that the changes made to the configuration were applied properly and are being correctly synchronized to Microsoft Entra ID.

The following document will guide you through on-demand provisioning with Microsoft Entra Cloud Sync for provisioning from Active Directory to Microsoft Entra ID. If you are looking for information on provisioning from Microsoft Entra ID to AD, see On-demand provisioning - Active Directory to Microsoft Entra ID

The following is true with regrad to on-demand provisioning of groups:

• On-demand provisioning of groups supports updating up to five members at a time.
• On-demand provisioning doesn't support deleting groups that have been deleted from Microsoft Entra ID. Those groups don't appear when you search for a group.
• On-demand provisioning doesn't support nested groups that aren't directly assigned to the application.
• The on-demand provisioning request API can only accept a single group with up to five members at a time.

Verify a group

To use on-demand provisioning, follow these steps:

Note

When using on-demand provisioning, members aren't automatically provsisioned. You need to select which members you wish to test on and there's a five member limit.

1. Sign in to the Microsoft Entra admin center as at least a Hybrid Administrator.
2. Browse to Identity > Hybrid management > Microsoft Entra Connect > Cloud sync.

3. Under Configuration, select your configuration.
4. On the left, select Provision on demand.
5. Enter the name of the group in the Selected group box
6. From the Selected users section, select some users to test.

7. Click Provision.
8. You should see the group provisioned.

For more information, see on-demand provisioning.

Next steps

• Group writeback with Microsoft Entra Cloud Sync
• Govern on-premises Active Directory based apps (Kerberos) using Microsoft Entra ID Governance
• Migrate Microsoft Entra Connect Sync group writeback V2 to Microsoft Entra Cloud Sync