Windows Server Active Directory Groups vs Microsoft Entra Cloud Groups
Question details
The user needs to understand the functional differences between on-premises Windows Server Active Directory groups and cloud-only Microsoft Entra groups, as well as how they are managed in a hybrid setup.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Planning and managing user identities and group structures in a hybrid enterprise environment.
- Observed behavior
- Seeking detailed information on synchronization capabilities, management limits, and membership rules for on-premises versus cloud-only groups.
Verify your current administrative access levels in both your on-premises Windows Server environment and the Microsoft Entra admin center before attempting synchronization.
Synchronize On-Premises Groups with Microsoft Entra ID
Use Microsoft Entra Connect to bridge your on-premises Active Directory with Microsoft Entra ID to establish a unified hybrid identity ecosystem.
By synchronizing your on-premises identities to the cloud, you allow users to access Microsoft 365 and other cloud-based services using their existing organizational credentials.
Download and install the Microsoft Entra Connect synchronization tool on a dedicated on-premises Windows Server.
Run the configuration wizard to link your local Active Directory forest with your Microsoft Entra ID tenant, specifying which organizational units (OUs) to sync.
Open the Microsoft Entra admin center and check the synchronization logs to ensure your on-premises users and groups are successfully populating in the cloud environment.
Manage Cloud-Only Groups Directly in Microsoft Entra ID
Create and manage distinct groups that exist entirely in the cloud for modern access controls and dynamic automation.
Empower Your Hybrid Workforce with WPS Office
While configuring your infrastructure's identity management with Active Directory and Entra ID, ensure your team is equipped with a lightweight, secure, and cost-effective productivity suite. WPS Office delivers seamless document collaboration for modern enterprise deployments.
Frequently Asked Questions
Can I edit an on-premises synchronized group directly in Microsoft Entra ID?
No, groups that are synchronized from an on-premises Active Directory cannot be edited in the cloud. Changes must be made in the local Active Directory and then synced back to Microsoft Entra ID.
What is the primary benefit of creating a cloud-only Microsoft Entra group?
Cloud-only groups allow administrators to utilize modern features like dynamic group memberships based on specific user attributes, and they do not require local server infrastructure to maintain.
Does Microsoft Entra Connect sync user passwords as well as group memberships?
Yes, Microsoft Entra Connect can be configured to use Password Hash Synchronization (PHS) or Pass-through Authentication (PTA) alongside standard group and user identity synchronization.
