Does Group Writeback also support Security groups created on Entra ID or just M365 groups?

Question

Does Group Writeback also support Security groups created on Entra ID or just M365 groups?

Abhishek Asija 40

Hi Everyone,

I am testing the Microsoft Entra Connect Group Writeback feature. so far it is able to sync back the M365 groups created in Entra ID to on-premises AD in the designated OU.

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-group-writeback-v2 - as per this article Security groups should also sync back but it's not happening.

a) The M365 group is set to "No writeback" on Entra ID but it still synchronizes to on-premises AD

b) Security group is set to "Security" under Writeback property, but it never sync back to on-premises AD.

Kindly suggest.

Thanks,

Abhishek

Michael Smith 2,926 Reputation points Microsoft Employee

2023-10-12T13:14:19.5933333+00:00
Hi Abhishek,

Thank you for contacting the community for your issue.

I have just tested using the documentation and its working ok for me for security and M365 groups enabled for writeback.

If you create a new security group and enable for writeback does it work?

Just checking if there is a limitation applying to your current groups.

Does your security groups have nested groups?

Nested cloud groups that are members of writeback enabled groups must also be enabled for writeback to remain nested in AD.

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-group-writeback-v2#understand-limitations-of-public-preview
Abhishek Asija 40 Reputation points

2023-10-12T13:20:36.9033333+00:00

Hi Michael,

Thank you for your response. I have tested with creating two groups: one M365 group and one Entra ID security group. the M365 group synced back successfully but the security group never did.

Both the groups have the group writeback state updated as "Security"

Thanks,

Abhishek
Michael Smith 2,926 Reputation points Microsoft Employee

2023-10-12T13:25:33.46+00:00

I see both groups appear to have the same name. can you test with different names please.
Abhishek Asija 40 Reputation points

2023-10-12T13:57:39.1133333+00:00

Hi Micheal,

Tested with two groups with different names just now but only the M365 group got written to on-premises AD.
Abhishek Asija 40 Reputation points

2023-10-12T14:00:34.81+00:00
Hi Michael,

Tested with two groups with different names but only the M365 group gets written to on-premises AD.

Tested now by following below steps:

Disabled Group Writeback on Microsoft Entra Connect

Ran full sync

Made sure that groups are removed from on-premises AD

Enabled Group Writeback on Microsoft Entra Connect

Created the security group on Entra ID

Ran the delta sync

M365 group got synced successfully to on-premises AD

Thanks,

Abhishek
Michael Smith 2,926 Reputation points Microsoft Employee

2023-10-12T15:18:05.1333333+00:00

Thats odd the security groups not getting sync'd back.

Is it showing up in the sync service delta import operation?

have you run an initial sync since enabling it?
Abhishek Asija 40 Reputation points

2023-10-12T15:21:07.7933333+00:00

Tried with Initial sync too post adding the comment, but no benefit there.

Have also tried checking the group in the Metaverse but its not at all visible.

Not sure what else to look for so stopped
Michael Smith 2,926 Reputation points Microsoft Employee

2023-10-12T15:54:15.92+00:00

What version of AD connect are you using?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Accepted answer

0 additional answers

Your answer

Michael Smith 2,926 Reputation points Microsoft Employee

2023-10-12T13:14:19.5933333+00:00

Hi Abhishek,

Thank you for contacting the community for your issue.

I have just tested using the documentation and its working ok for me for security and M365 groups enabled for writeback.

If you create a new security group and enable for writeback does it work?

Just checking if there is a limitation applying to your current groups.

Does your security groups have nested groups?

Nested cloud groups that are members of writeback enabled groups must also be enabled for writeback to remain nested in AD.

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-group-writeback-v2#understand-limitations-of-public-preview
Abhishek Asija 40 Reputation points

2023-10-12T13:20:36.9033333+00:00

Hi Michael,

Thank you for your response. I have tested with creating two groups: one M365 group and one Entra ID security group. the M365 group synced back successfully but the security group never did.

Both the groups have the group writeback state updated as "Security"

Thanks,

Abhishek
Michael Smith 2,926 Reputation points Microsoft Employee

2023-10-12T13:25:33.46+00:00

I see both groups appear to have the same name. can you test with different names please.
Abhishek Asija 40 Reputation points

2023-10-12T13:57:39.1133333+00:00

Hi Micheal,

Tested with two groups with different names just now but only the M365 group got written to on-premises AD.
Abhishek Asija 40 Reputation points

2023-10-12T14:00:34.81+00:00

Hi Michael,

Tested with two groups with different names but only the M365 group gets written to on-premises AD.

Tested now by following below steps:

Disabled Group Writeback on Microsoft Entra Connect

Ran full sync

Made sure that groups are removed from on-premises AD

Enabled Group Writeback on Microsoft Entra Connect

Created the security group on Entra ID

Ran the delta sync

M365 group got synced successfully to on-premises AD

Thanks,

Abhishek
Michael Smith 2,926 Reputation points Microsoft Employee

2023-10-12T15:18:05.1333333+00:00

Thats odd the security groups not getting sync'd back.

Is it showing up in the sync service delta import operation?

have you run an initial sync since enabling it?
Abhishek Asija 40 Reputation points

2023-10-12T15:21:07.7933333+00:00

Tried with Initial sync too post adding the comment, but no benefit there.

Have also tried checking the group in the Metaverse but its not at all visible.

Not sure what else to look for so stopped
Michael Smith 2,926 Reputation points Microsoft Employee

2023-10-12T15:54:15.92+00:00

What version of AD connect are you using?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

It appears your still using group write back v1 which only supports m365 groups

There are two versions of group writeback. The original version is in general availability and is limited to writing back Microsoft 365 groups to your on-premises Active Directory instance as distribution groups. The new, expanded version of group writeback is in public preview and enables the following capabilities:

You can write back Microsoft 365 groups as distribution groups, security groups, or mail-enabled security groups.
You can write back Microsoft Entra security groups as security groups.

Please enable v2 using the powershell command as per doc.

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-group-writeback-enable#enable-group-writeback-by-using-powershell

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information

Abhishek Asija 40 Reputation points

2023-10-12T17:33:53.3666667+00:00

Thanks Michael. While this resolved the issue with Security groups not written back to on-premises AD, another issue popped up.

M365 group created months back got synced to on-premises AD, but this time the test M365 group "writeback testing" is not written back to on-premises AD, during a delta sync.

I had to run an initial sync again even though the security groups were written to on-premises AD to get the newly created M365 group sync.

Will test this feature again in couple of days, once I get some time and see if the behaviour changes

Share via

Does Group Writeback also support Security groups created on Entra ID or just M365 groups?

0 additional answers

Your answer