Group writeback in the Microsoft Entra admin center

  • Article

Important

The public preview of Group Writeback v2 in Microsoft Entra Connect Sync will no longer be available after June 30, 2024. This feature will be discontinued on this date, and you will no longer be supported in Connect Sync to provision cloud security groups to Active Directory. The feature will continue to operate beyond the discontinuation date; however, it will no longer receive support after this date and may cease functioning at any time without notice.

For customers who provision Microsoft 365 groups to Active Directory, you can keep using Group Writeback v1 for this capability.

Note

If you were previously writing Microsoft 365 groups back to on-premises Active Directory as universal distribution groups, they appear in the Azure portal as not enabled for writeback on both the Groups page and the properties page for a group. These pages display a new property introduced for the preview, writeback enabled. This property isn't set by the current version of Group Writeback to ensure backward compatibility with the legacy version of Group Writeback and to avoid breaking existing customer setups.

To understand the behavior of No writeback in the portal, you can view the writeback state via Microsoft Graph. For more information, see Get group.

Portal Microsoft Graph Behavior
Writeback isEnabled = null or true The group will be written back.
No writeback isEnabled = false The group won't be written back.
No writeback IsEnabled = null & onPremisesGroupType = null If it's a Microsoft 365 group, it's written back to on-premises Active Directory as a distribution group.
If it's a Microsoft Entra security group, it's written back to on-premises Active Directory.

By default, the Group writeback state of groups is set to No writeback. This means:

  • Microsoft 365 groups: If the group is IsEnabled = null and onPremisesGroupType = null, to ensure backward compatibility with older versions of Group Writeback, the group is written back to on-premises Active Directory as a distribution group.
  • Microsoft Entra security groups: If the group is IsEnabled = null and onPremisesGroupType = null, the group is written back to on-premises Active Directory.

Show writeback columns

On the All groups overview page, you can add the group writeback columns Target writeback type and Writeback enabled to the view. The Target writeback type and Writeback enabled columns are available for the view whether or not you have writeback enabled in Microsoft Entra Connect.

​ Screenshot that shows selecting columns for writeback in the All groups list.

Writeback column settings

The Writeback enabled column allows you to turn off the writeback capability for individual groups. The Target writeback type column allows you to specify to which group type you want this cloud group written back in on-premises Active Directory. For a Microsoft Entra Microsoft 365 group, you can write it back as a security group, a distribution group, or a mail-enabled security group. For a Microsoft Entra security group, you can write it back only as a security group.

Screenshot that shows writeback settings columns that are visible on the All groups page.

Writeback settings in group properties

You can also configure writeback settings for a group on the property page for the group. There's a Group writeback state setting that allows you to turn off writeback for the group or to specify the writeback group type. When No writeback is selected, the group isn't written back. If you select one of the other writeback types as an option (for example, security), then you have:

  • Enabled the group for writeback.
  • Targeted the writeback type as a security group.

Screenshot that shows changing writeback settings in the group properties.

Read the writeback configuration by using PowerShell

You can use PowerShell to get a list of writeback-enabled groups by using the following PowerShell Get-MgGroup cmdlet.

Connect-MgGraph -Environment China -ClientId 'YOUR_CLIENT_ID' -TenantId 'YOUR_TENANT_ID' -Scopes @('Group.Read.all')
Select-MgProfile -Name beta
PS D:\> Get-MgGroup -All |Where-Object {$_.writebackConfiguration.isEnabled -Like $true} |Select-Object Displayname,@{N="WriteBackEnabled";E={$_.writebackConfiguration.isEnabled}}

DisplayName WriteBackEnabled
----------- ----------------
CloudGroup1           True
CloudGroup2           True

Next steps