Daily.Entra.NewsThe week centered on a group-focused rewrite of Microsoft Entra Cloud Sync guidance for provisioning to AD DS. Microsoft added a dedicated tutorial, recast the main configuration article around groups, documented explicit topology assumptions, and revised on-demand testing. Several broad users-and-groups reference pages were removed. Separately, Global Secure Access published preview guidance for custom HTTP headers through Web Content Filtering v2, with TLS inspection and other prerequisites.
Global Secure Access · GeneralThe new guidance describes adding custom HTTP headers to matching outbound web requests through Web Content Filtering v2 rules. It covers tenant restrictions and other header-aware services. Administrators must configure TLS inspection and meet the documented Global Secure Access prerequisites to use the capability.
Entra ID · ProvisioningThe new tutorial explains provisioning groups from Microsoft Entra ID to on-premises Active Directory Domain Services, including Entra-to-AD and AD-to-Entra scenarios, source-of-authority behavior, and membership effects. It recommends Selected security groups as the default scoping filter to help prevent performance issues.
Entra ID · ProvisioningThe rewritten procedure adds setup steps, screenshots, and sections covering scoping, attribute mapping, testing, and default settings. Its previous combined users-and-groups guidance was removed, and the article now includes a deprecation notice.
Entra ID · ProvisioningThe updated planning guidance says cloud-synced groups can contain only on-premises synchronized users and additional cloud-created security groups, and that all users must have `onPremisesObjectIdentifier`. Administrators should compare existing group designs with these documented conditions.
Entra ID · ProvisioningThe updated procedure tells administrators to select a group and manually choose up to five members for testing. User-specific instructions and result-review details were removed, and the provisioning-direction references were updated.
Cloud Sync administrators should use the new group tutorial and rewritten configuration guidance, review designs against the documented membership and `onPremisesObjectIdentifier` requirements, and use the group test flow with no more than five members. Teams evaluating Global Secure Access custom headers must configure TLS inspection and meet the documented prerequisites. Older consolidated provisioning pages, including prerequisite and test-and-enable guidance, are no longer available.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The article was rewritten for provisioning groups from Microsoft Entra ID to Active Directory, adding updated setup steps, screenshots, and sections for scoping, attribute mapping, testing, and default settings. Previous combined users-and-groups guidance was removed, and a deprecation notice was added.
The documentation now states that cloud-synced groups can contain only on-premises synchronized users and additional cloud-created security groups, and that all users must have `onPremisesObjectIdentifier`. The example link and diagram descriptions were also updated.
The article now describes extending a group schema attribute and using it to filter groups provisioned to Active Directory. It replaces the previous combined users-and-groups examples with a group-focused scenario and setup instructions.
A new tutorial explains how to configure Microsoft Entra Cloud Sync to provision groups to on-premises AD DS. It covers Entra-to-AD and AD-to-Entra scenarios, including how source of authority and membership affect provisioning.
The 246-line tutorial for provisioning cloud-managed users and groups to Active Directory with Microsoft Entra Cloud Sync was deleted. It covered preview user provisioning for access to an on-premises Kerberos application.
The article now documents selecting a group and up to five members for testing. User-specific instructions and result-review details were removed, and provisioning-direction references were updated.
The article was retitled and updated to focus on provisioning directory extensions to Active Directory with Cloud Sync, including group schema, scoping, and attribute mapping. Links now point to updated Cloud Sync resources and a group-provisioning scenario.
The article’s introduction now describes on-demand provisioning from Microsoft Entra ID to Active Directory and links to related guidance.
The article explaining how Microsoft Entra Cloud Sync provisions users, groups, and memberships to Active Directory was deleted.
The article covering prerequisites and license requirements for provisioning users and groups from Microsoft Entra ID to on-premises Active Directory with Cloud Sync was deleted, along with its related links and next-step guidance.
The how-to page for testing and enabling Microsoft Entra ID to Active Directory provisioning was deleted, including guidance on on-demand tests, default properties, enabling configurations, quarantines, restarting sync, and removing configurations.
The guidance now links to the group provisioning tutorial and its updated section on nested groups and membership references.
The article comparing group-only, user-only, and users-and-groups provisioning from Microsoft Entra ID to Active Directory was deleted, including guidance on scoping, configuration limits, and performance.
The documentation page describing Microsoft Entra Cloud Sync provisioning of users, groups, and memberships from Entra ID to Active Directory was deleted.
The article describing the preview GroupDN setup for preserving a group’s organizational unit and name during Source of Authority conversion was deleted.
The documentation now points administrators to the Microsoft Entra Cloud Sync tutorial for provisioning groups to Active Directory Domain Services, replacing the previous provisioning overview and on-premises app governance links.
The Access guidance now points to an updated Microsoft Entra Cloud Sync documentation link for provisioning groups to Active Directory.
The documentation now provides step-by-step My Access portal instructions for authorized users to request an access package for another user, including the US Government portal URL.
The documentation now links to the Microsoft Entra Cloud Sync group provisioning tutorial instead of the configuration guide.
The guidance for recreating AD DS groups as cloud security groups, provisioning them as Universal groups, and updating applications to use their new security identifiers was revised.
The documentation now uses a new screenshot showing configuration of an access package’s request-on-behalf-of policy.
New documentation describes adding custom HTTP headers to matching outbound web requests through Web Content Filtering v2 rules. The capability is currently in preview and supports tenant restrictions and other header-aware services.
