How do I hard match on premise groups with Azure AD groups?

IPSO Joe 0 Reputation points

We've recently changed domains and moved into a new forest. We're running server 2022 and the latest version of Azure AD. I have Azure AD connect configured to sync using mS-DS-consistencyGuid. When syncing the users, I had to do a hard match, converting the on premise objectGUID for each user to base64 and writing it to the Azure AD immutable ID attribute. That was simple enough. When it comes to the on premise groups, in powershell, I can't write to the immutable ID/ Source Anchor attribute. Everything I've read has either been for an older version of Azure or suggested that all I need to do is set up sync to use mS-DS-consistencyGuid.

Azure Active Directory
Azure Active Directory
An Azure enterprise identity service that provides single sign-on and multi-factor authentication.
12,773 questions
No comments
{count} votes

1 answer

Sort by: Most helpful
  1. BOURBITA Thameur 12,626 Reputation points MVP


    Did you try to copy the GUID of the old on-premise group in the attribut ms-ds-consistency-guid of new on-premise group ?

    You can also convert immutable ID of the azure group using the powershell command below and copy it in MS-DS-Consistency-Guid

    $ms-DS-Consistency-GUID = [GUID]([system.convert]::FromBase64String($base64))

    Please don't forget to mark helpful answer as accepted