How to Sync User From Entra ID to On-Premises AD?

Question

How to Sync User From Entra ID to On-Premises AD?

FUADHASAN ADISURYO BIN ACHMAD ROFIIE 0

I have users from Microsoft Entra ID that I want to be synchronized automatically from Entra ID to the on-premises Active Directory. I have already run Cloud Sync (Microsoft Entra ID to AD Sync) and installed the Microsoft Entra Provisioning Agent.

However, the user that I want to provision automatically is not created in the on-premises Active Directory, while the group is successfully created. When I run Provision on Demand, the user provisioning process is skipped.

Provisioning Log (User):

2/5/26, 10:37:05 AM

Display name: demo02

Source ID: PII

Operation: Create

Source: Microsoft Entra ID

Target: Active Directory

Result: Skipped

Group:

Display name: PII

Object ID: PII

EntrySynchronizationSkip

Result: Skipped

Description: The user 'PII' was skipped for the following reasons:

This object is not assigned to the application. If this behavior is not expected, assign the object to the application or change the scoping filter to allow all users and groups to be in scope for provisioning.

This object does not have the required entitlement for provisioning. If this behavior is not expected, update the provisioning scope to “Sync all users and groups” or assign the object to the application with the appropriate provisioning entitlement.

This object did not pass a scoping filter. If this behavior is not expected, review the scoping filters and ensure that the object meets the defined scoping criteria.

Scope evaluation result:

{"On-prem Owned Users.dirSyncEnabled IS TRUE": false}

Additional Details

SkipReason: NotEffectivelyEntitled

IsActive: True

Assigned to the application: False

IsInProvisioningScope: False

ReportableIdentifier: PII have users from Microsoft Entra ID that I want to be synchronized automatically from Entra ID to the on-premises Active Directory. I have already run Cloud Sync (Microsoft Entra ID to AD Sync) and installed the Microsoft Entra Provisioning Agent. However, the user that I want to provision automatically is not created in the on-premises Active Directory, while the group is successfully created. When I run Provision on Demand, the user provisioning process is skipped. Provisioning Log (User): 2/5/26, 10:37:05 AM
- Display name: demo02
- Source ID: PII
- Operation: Create
- Source: Microsoft Entra ID
- Target: Active Directory
- Result: Skipped
Group:
- Display name: PII
- Object ID: PII
  EntrySynchronizationSkip
  Result: Skipped Description:
  The user 'PII' was skipped for the following reasons:
1. This object is not assigned to the application.
  If this behavior is not expected, assign the object to the application or change the scoping filter to allow all users and groups to be in scope for provisioning.
2. This object does not have the required entitlement for provisioning.
  If this behavior is not expected, update the provisioning scope to “Sync all users and groups” or assign the object to the application with the appropriate provisioning entitlement.
3. This object did not pass a scoping filter.
  If this behavior is not expected, review the scoping filters and ensure that the object meets the defined scoping criteria.
Scope evaluation result:
```
  {"On-prem Owned Users.dirSyncEnabled IS TRUE":
```
Additional Details
- SkipReason: NotEffectivelyEntitled
- IsActive: True
- Assigned to the application: False
- IsInProvisioningScope: False
- ReportableIdentifier: PII

Rukmini 42,515 Reputation points Microsoft External Staff Moderator

2026-02-05T09:02:40.0266667+00:00
Hey Fuad, it sounds like you're encountering an issue with synchronizing a user from Microsoft Entra ID to your on-premises Active Directory. Since the user provisioning process is being skipped, let's explore some potential solutions based on the error log details you provided.

Here's what you can try:

Assign the User to the Application:

The log indicates that the user is "not assigned to the application." You should ensure that the user in Entra ID is assigned to the appropriate application that is involved in the provisioning process. If it's not, you can assign the user to the application from the Microsoft Entra admin center.

Check the Scoping Filter:

The message mentions that the user didn't pass a scoping filter. Review your scoping filters to ensure that the user meets the defined criteria for provisioning. Adjust the filters if necessary to include the user.

Entitlement Configuration:

Make sure that the user has the required entitlements for provisioning. If it’s not expected behavior, you may want to change the provisioning scope to “Sync all users and groups” or provide the necessary rights to the user.

Validate Account Properties:

The error log also notes that the property dirSyncEnabled IS TRUE is evaluated as false. Ensure that the on-premises user account is correctly configured and that it has the dirSyncEnabled attribute set to true.

Run a Full Sync:

Sometimes just running a "Provision on Demand" might not rectify the issue. Perform a full synchronization by executing the following command on the server running Microsoft Entra Connect:
Start-ADSyncSyncCycle -PolicyType Initial

Additional Considerations:

Make sure there are no conflicting user objects in Entra ID or on-premises AD.

Review the user object thoroughly to ensure there are no missing required attributes.

Reference Documentation:

What is Microsoft Entra Cloud Sync?

What is the Microsoft Entra provisioning agent?

Troubleshoot Cloud Sync - Object Synchronization Problems

Plan your AD to Entra ID or Entra ID to AD deployment using Cloud Sync

If you can provide answers to a few follow-up questions, I might be able to give you more tailored advice:

Follow-Up Questions:

Is the user you're trying to provision already present in on-premises AD, or is it a new user?

Have you defined any specific scoping filters for the synchronization?

Are there any other related logs that might indicate permissions issues?

Can you confirm whether the user assigned the required roles/entitlements in Entra ID?

Hope this helps, and let me know if you have any other questions!

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Rukmini 42,515 Reputation points Microsoft External Staff Moderator

2026-02-19T12:12:20.0033333+00:00

FUADHASAN ADISURYO BIN ACHMAD ROFIIE Following up to see if the above provided information was helpful. If you have any further queries do let us know.

1 answer

Your answer

Rukmini 42,515 Reputation points Microsoft External Staff Moderator

2026-02-19T12:12:20.0033333+00:00

FUADHASAN ADISURYO BIN ACHMAD ROFIIE Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

To synchronize users from Microsoft Entra ID to on-premises Active Directory (AD), you need to ensure that the users meet the necessary criteria for provisioning. Based on the log details you provided, the user provisioning process was skipped due to several reasons:

Not Assigned to the Application: The user is not assigned to the application. You need to assign the user to the application or adjust the scoping filter to include all users and groups.
Lack of Required Entitlement: The user does not have the required entitlement for provisioning. You can either update the provisioning scope to "Sync all users and groups" or assign the user to the application with the appropriate provisioning entitlement.
Scoping Filter Issues: The user did not pass the scoping filter. Review the scoping filters to ensure that the user meets the criteria defined for provisioning.

To resolve these issues, consider the following steps:

Assign the user to the application that is configured for provisioning.
Ensure that the user has the necessary entitlements for provisioning.
Review and modify the scoping filters as needed to include the user in the provisioning scope.

Once these adjustments are made, you can attempt the provisioning process again.

Share via

How to Sync User From Entra ID to On-Premises AD?

EntrySynchronizationSkip

Additional Details

EntrySynchronizationSkip

Additional Details

Here's what you can try:

Additional Considerations:

Reference Documentation:

Follow-Up Questions:

1 answer

Your answer