Additional Microsoft Entra services and features related to identity, access, and network security
Group Writeback v2 in Microsoft Entra Connect Sync is deprecated and no longer supported, and it cannot be newly enabled in a tenant.
For current and future scenarios:
- Use Microsoft Entra Cloud Sync for group writeback of cloud security groups to on-premises AD DS.
- Cloud Sync can provision cloud security groups directly to on-premises Active Directory.
- This is the recommended replacement for Group Writeback v2.
- Continue using Group Writeback v1 only if Microsoft 365 groups must be written back to on-premises AD (for example, in Exchange hybrid scenarios).
- Group Writeback v1 in Microsoft Entra Connect Sync still functions for Microsoft 365 groups and can be enabled via the Microsoft Entra Connect wizard under Optional features → Group writeback and targeting an on-premises OU.
- Migration guidance:
- If Group Writeback v2 was previously in use, move the sync client to Microsoft Entra Cloud Sync using the user synchronization wizard where eligible.
- If Cloud Sync cannot fully replace Entra Connect in the environment, run Microsoft Entra Cloud Sync side-by-side with Microsoft Entra Connect Sync and use Cloud Sync only to provision cloud security groups to on-premises AD DS.
Enabling Group Writeback v2 specifically is no longer supported; the supported options are Group Writeback v1 (for Microsoft 365 groups) and Microsoft Entra Cloud Sync group provisioning (for security groups).
References:
- Group writeback with Microsoft Entra Cloud Sync
- Group writeback for Microsoft 365 groups
- Govern on-premises Active Directory based apps (Kerberos) with Microsoft Entra Cloud Sync
- Configure Microsoft 365 Groups with on-premises Exchange hybrid
- Modify Microsoft Entra Connect group writeback default behavior