Modify Microsoft Entra Connect group writeback default behavior

Group writeback is a feature that allows you to write cloud groups back to your on-premises Active Directory instance by using Microsoft Entra Connect Sync. You can change the default behavior in the following ways:

• Only groups that are configured for writeback will be written back, including newly created Microsoft 365 groups.
• Groups that are written back will be deleted in Active Directory when they're disabled for group writeback, soft deleted, or hard deleted in Microsoft Entra ID.
• Microsoft 365 groups with up to 250,000 members can be written back to on-premises.

This article walks you through the options for modifying the default behaviors of Microsoft Entra Connect group writeback.

Considerations for existing deployments

If the original version of group writeback is already enabled and in use in your environment, all your Microsoft 365 groups have already been written back to Active Directory. Instead of disabling all Microsoft 365 groups, review any use of the previously written-back groups. Disable only those that are no longer needed in on-premises Active Directory.

Disable automatic writeback of new Microsoft 365 groups

To configure directory settings to disable automatic writeback of newly created Microsoft 365 groups, use one of these methods:

• PowerShell: Use the Microsoft Graph Beta PowerShell SDK. For example:

    # Import Module
    Import-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
  
    #Connect to MgGraph with necessary scope
    Connect-MgGraph -Environment China -ClientId 'YOUR_CLIENT_ID' -TenantId 'YOUR_TENANT_ID' -Scopes Directory.ReadWrite.All
  
  
    # Verify if "Group.Unified" directory settings exist
    $DirectorySetting = Get-MgBetaDirectorySetting| Where-Object {$_.DisplayName -eq "Group.Unified"}
  
    # If "Group.Unified" directory settings exist, update the value for new unified group writeback default
    if ($DirectorySetting) 
    {
      $params = @{
        Values = @(
          @{
            Name = "NewUnifiedGroupWritebackDefault"
            Value = $false
          }
        )
      }
      Update-MgBetaDirectorySetting -DirectorySettingId $DirectorySetting.Id -BodyParameter $params
    }
    else
    {
      # In case the directory setting doesn't exist, create a new "Group.Unified" directory setting
      # Import "Group.Unified" template values to a hashtable
      $Template = Get-MgBetaDirectorySettingTemplate | Where-Object {$_.DisplayName -eq "Group.Unified"}
      $TemplateValues = @{}
      $Template.Values | ForEach-Object {
          $TemplateValues.Add($_.Name, $_.DefaultValue)
      }
  
      # Update the value for new unified group writeback default
      $TemplateValues["NewUnifiedGroupWritebackDefault"] = $false
  
      # Create a directory setting using the Template values hashtable including the updated value
      $params = @{}
      $params.Add("TemplateId", $Template.Id)
      $params.Add("Values", @())
      $TemplateValues.Keys | ForEach-Object {
          $params.Values += @(@{Name = $_; Value = $TemplateValues[$_]})
      }
      New-MgBetaDirectorySetting -BodyParameter $params
    }
  

• Microsoft Graph: Use the directorySetting resource type.

Disable writeback for all existing Microsoft 365 group

To disable writeback of all Microsoft 365 groups that were created before these modifications, use one of the following methods:

• Portal: Use the Microsoft Entra admin center.

• PowerShell: Use the Microsoft Graph Beta PowerShell SDK. For example:

    #Import-module
    Import-Module Microsoft.Graph.Beta
  
    #Connect to MgGraph with necessary scope
    Connect-MgGraph -Environment China -ClientId 'YOUR_CLIENT_ID' -TenantId 'YOUR_TENANT_ID' -Scopes Group.ReadWrite.All
  
    #List all Microsoft 365 Groups
    $Groups = Get-MgBetaGroup -All | Where-Object {$_.GroupTypes -like "*unified*"}
  
    #Disable Microsoft 365 Groups
    Foreach ($group in $Groups) 
    {
      Update-MgBetaGroup -GroupId $group.id -WritebackConfiguration @{isEnabled=$false}
    }
  

Delete groups when they're disabled for writeback or soft deleted

1. On your Microsoft Entra Connect server, open a PowerShell prompt as an administrator.

2. Disable the Microsoft Entra Connect Sync scheduler:

   Set-ADSyncScheduler -SyncCycleEnabled $false  
   

3. Create a custom synchronization rule in Microsoft Entra Connect to delete written-back groups when they're disabled for writeback or soft deleted:

   import-module ADSync 
   $precedenceValue = Read-Host -Prompt "Enter a unique sync rule precedence value [0-99]" 
   
   New-ADSyncRule  `
   -Name 'In from AAD - Group SOAinAAD Delete WriteBackOutOfScope and SoftDelete' `
   -Identifier 'cb871f2d-0f01-4c32-a333-ff809145b947' `
   -Description 'Delete AD groups that fall out of scope of Group Writeback or get Soft Deleted in Azure AD' `
   -Direction 'Inbound' `
   -Precedence $precedenceValue `
   -PrecedenceAfter '00000000-0000-0000-0000-000000000000' `
   -PrecedenceBefore '00000000-0000-0000-0000-000000000000' `
   -SourceObjectType 'group' `
   -TargetObjectType 'group' `
   -Connector 'b891884f-051e-4a83-95af-2544101c9083' `
   -LinkType 'Join' `
   -SoftDeleteExpiryInterval 0 `
   -ImmutableTag '' `
   -OutVariable syncRule
   
   Add-ADSyncAttributeFlowMapping  `
   -SynchronizationRule $syncRule[0] `
   -Destination 'reasonFiltered' `
   -FlowType 'Expression' `
   -ValueMergeType 'Update' `
   -Expression 'IIF((IsPresent([reasonFiltered]) = True) && (InStr([reasonFiltered], "WriteBackOutOfScope") > 0 || InStr([reasonFiltered], "SoftDelete") > 0), "DeleteThisGroupInAD", [reasonFiltered])' `
    -OutVariable syncRule
   
   New-Object  `
   -TypeName 'Microsoft.IdentityManagement.PowerShell.ObjectModel.ScopeCondition' `
   -ArgumentList 'cloudMastered','true','EQUAL' `
   -OutVariable condition0
   
   Add-ADSyncScopeConditionGroup  `
   -SynchronizationRule $syncRule[0] `
   -ScopeConditions @($condition0[0]) `
   -OutVariable syncRule
   
   New-Object  `
   -TypeName 'Microsoft.IdentityManagement.PowerShell.ObjectModel.JoinCondition' `
   -ArgumentList 'cloudAnchor','cloudAnchor',$false `
   -OutVariable condition0
   
   Add-ADSyncJoinConditionGroup  `
   -SynchronizationRule $syncRule[0] `
   -JoinConditions @($condition0[0]) `
   -OutVariable syncRule
   
   Add-ADSyncRule  `
   -SynchronizationRule $syncRule[0]
   
   Get-ADSyncRule  `
   -Identifier 'cb871f2d-0f01-4c32-a333-ff809145b947'
   

4. Enable group writeback.

5. Enable the Microsoft Entra Connect Sync scheduler:

   Set-ADSyncScheduler -SyncCycleEnabled $true  
   

Write back Microsoft 365 groups with up to 250,000 members

Because the default sync rule that limits the group size is created when group writeback is enabled, you must complete the following steps after you enable group writeback:

1. On your Microsoft Entra Connect server, open a PowerShell prompt as an administrator.

2. Disable the Microsoft Entra Connect Sync scheduler:

   Set-ADSyncScheduler -SyncCycleEnabled $false  
   

3. Open the synchronization rule editor.

4. Set the direction to Outbound.

5. Locate and disable the Out to AD - Group Writeback Member Limit synchronization rule.

6. Enable the Microsoft Entra Connect Sync scheduler:

   Set-ADSyncScheduler -SyncCycleEnabled $true  
   

Restore from Active Directory Recycle Bin

If you're updating the default behavior to delete groups when they're disabled for writeback or soft deleted, we recommend that you enable the Active Directory Recycle Bin feature for your on-premises instances of Active Directory. You can use this feature to manually restore previously deleted Active Directory groups so that they can be rejoined to their respective Microsoft Entra groups, if they were accidentally disabled for writeback or soft deleted.

Before you re-enable for writeback or restore from soft delete in Microsoft Entra ID, you first need to restore the group in Active Directory.

Next steps

• Microsoft Entra Connect group writeback
• Enable Microsoft Entra Connect group writeback
• Disable Microsoft Entra Connect group writeback