Azure AD Connect v2 group write back

Question

Azure AD Connect v2 group write back

Pete Benn 0

Hello, I have installed AAD connect 2.2.8 and enabled group write back, it is configured to only create write back enabled groups to our local AD. I have set to not write back new groups.

it syncs ok, but every group is created. I delete a group from the local AD OU and it syncs it back again.

what am I doing wrong?

Carlos Solís Salazar 18,376 Reputation points MVP Volunteer Moderator

2023-11-28T00:10:52.72+00:00

Can you share the synchronization logs?
JamesTran-MSFT 37,231 Reputation points Microsoft Employee Moderator

2023-12-05T20:26:07.14+00:00

@Pete Benn

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

2 answers

Your answer

Carlos Solís Salazar 18,376 Reputation points MVP Volunteer Moderator

2023-11-28T00:10:52.72+00:00

Can you share the synchronization logs?
JamesTran-MSFT 37,231 Reputation points Microsoft Employee Moderator

2023-12-05T20:26:07.14+00:00

@Pete Benn

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 1

Andy David - MVP 159.9K MVP Volunteer Moderator

Seems to me that if you migrate group sync to Entra Cloud sync, you can prevent 365 group writeback:

Pete Benn 0 Reputation points

2023-11-28T13:37:27.4733333+00:00
As our groups are Microsoft 365 groups I don't think this applies?

Supported groups

For this scenario, only the following is supported:

only cloud created Security groups are supported
Andy David - MVP 159.9K Reputation points MVP Volunteer Moderator

2023-11-28T15:10:30.6833333+00:00

Ok, you want to writeback 365 groups. Gotcha, I was thinking you didnt.
Pete Benn 0 Reputation points

2023-11-28T15:24:11.6466667+00:00

yes but only those that I choose

Answer 2

Sandeep G-MSFT 21,131 Microsoft Employee Moderator

@Pete Benn

Thank you for posting this in Microsoft Q&A.

As I understand you have upgraded to AD connect (Microsoft Entra Connect) version 2.2.8 and group writeback is enabled.

But with this feature enabled all groups are getting written back to on-premises AD even though you have set groups not to write back.

This is a default behavior in group writeback V2.

When you're enabling group writeback, you'll experience the following default behavior:

All existing Microsoft 365 groups will automatically be written back to Active Directory, including all Microsoft 365 groups created in the future. Microsoft Entra security groups are not automatically written back. They must each be enabled for writeback.
Groups that have been written back won't be deleted in Active Directory if they're disabled for writeback or soft deleted. They'll remain in Active Directory until they're hard deleted in Microsoft Entra ID.

Changes made to these groups in Microsoft Entra ID won't be written back until the groups are re-enabled for writeback or restored from a soft-delete state. This requirement helps protect the Active Directory groups from accidental deletion, if they're unintentionally disabled for writeback or soft deleted in Microsoft Entra ID.

Microsoft 365 groups with more than 50,000 members and Microsoft Entra security groups with more than 250,000 members can't be written back to on-premises.

In above explanation you can see the first point due to which you are seeing this behavior.

It is mentioned in our public article as well.

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-group-writeback-v2#choose-the-right-approach

But you can change this default behavior by following steps in below article,

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-modify-group-writeback#disable-automatic-writeback-of-new-microsoft-365-groups

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-modify-group-writeback#delete-groups-when-theyre-disabled-for-writeback-or-soft-deleted

You will have to use PowerShell to make these changes.

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Pete Benn 0 Reputation points

2023-11-28T09:33:25.1033333+00:00
I have set the new groups behaviour to be false.

FYI :

I read BOTH UnifiedGroupWriteback and GroupWritebackV2 (from Get-ADSyncAADCompanyFeature) needs to be set to $true is that right?

The groups in Entra are Group Type 'Microsoft 365' and they are being written back, we do not want this (see screenshot .doc)
Pete Benn 0 Reputation points

2023-11-28T12:35:31.9033333+00:00
I don't know where my previous reply went, apologies if this is a repeat:

FYI:

I have disabled writeback of new groups as article

Only 1 test group has writeback enabled

get-adsyncaadcompanyfeature shows

UnifiedGroupWriteBack - $false

GroupWritebackv2 - $true
(I have tested this with both set as $true but we get the same sync all behaviour)

The groups types are 'Microsoft 365'

To clarify I am trying to get only groups synced that I manually set as 'Writeback enabled' but they are all currently syncing to the local AD OU.
Pete Benn 0 Reputation points

2023-11-28T13:23:29.6866667+00:00
Looking at your last comment Sandeep, does this mean there is no way to prevent writeback of every group if they're 365 groups?

"This is a default behavior in group writeback V2. When you're enabling group writeback, you'll experience the following default behavior:

All existing Microsoft 365 groups will automatically be written back to Active Directory..."
Sandeep G-MSFT 21,131 Reputation points Microsoft Employee Moderator

2023-11-29T03:45:50.4166667+00:00

@Pete Benn

Yes, this is a default behavior where All existing Microsoft 365 groups will automatically be written back to Active Directory

But you can change this default behavior by following steps in below article,

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-modify-group-writeback#disable-automatic-writeback-of-new-microsoft-365-groups

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-modify-group-writeback#delete-groups-when-theyre-disabled-for-writeback-or-soft-deleted

Let me know if you have made changes using steps in above article

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Sandeep G-MSFT 21,131 Reputation points Microsoft Employee Moderator

2023-12-06T08:39:58.8+00:00

@Pete Benn

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread.

Share via

Azure AD Connect v2 group write back

2 answers

Your answer