You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/how-to-connect-group-writeback-disable.md
+31-32Lines changed: 31 additions & 32 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: 'Disable group writeback in Azure AD Connect'
3
-
description: This article describes how to disable Group Writeback in Azure AD Connect.
3
+
description: This article describes how to disable group writeback in Azure AD Connect by using the wizard and PowerShell.
4
4
services: active-directory
5
5
author: billmath
6
6
manager: amycolannino
@@ -14,48 +14,47 @@ ms.author: billmath
14
14
ms.collection: M365-identity-device-management
15
15
---
16
16
17
-
# Disabling group writeback
18
-
The following document will walk you thorough disabling group writeback. To disable group writeback for your organization, use the following steps:
17
+
# Disable group writeback
18
+
This article walks you through disabling group writeback in Azure Active Directory (Azure AD) Connect.
19
19
20
-
1. Launch the Azure Active Directory Connect wizard and navigate to the Additional Tasks page. Select the Customize synchronization options task and click next.
21
-
2. On the Optional Features page, uncheck group writeback. You'll receive a warning letting you know that groups will be deleted. Click Yes.
22
-
>[!Important]
23
-
>Disabling Group Writeback will cause any groups that were previously created by this feature to be deleted from your local Active Directory on the next synchronization cycle.
24
-
25
-
3. Uncheck the box
26
-
4. Click Next.
27
-
5. Click Configure.
20
+
## Disable group writeback by using the wizard
28
21
22
+
1. Open the Azure AD Connect wizard and go to the **Additional Tasks** page. Select the **Customize synchronization options task**, and then select **Next**.
23
+
2. On the **Optional Features** page, clear the checkbox for group writeback. In the warning that groups will be deleted, select **Yes**.
24
+
25
+
> [!IMPORTANT]
26
+
> Disabling group writeback sets the flags for full import and full synchronization in Active Directory Connect to `true`. It will cause any groups that were previously created by this feature to be deleted from your local Active Directory instance in the next synchronization cycle.
29
27
30
-
>[!Note]
31
-
>Disabling Group Writeback will set the Full Import and Full Synchronization flags to 'true' on the Azure Active Directory Connector, causing the rule changes to propagate through on the next synchronization cycle, deleting the groups that were previously written back to your Active Directory.
28
+
3. Select **Next**.
29
+
4. Select **Configure**.
32
30
33
-
34
31
35
-
## Rolling back group writeback
32
+
## Disable or roll back group writeback via PowerShell
36
33
37
-
To disable or roll back group writeback via PowerShell, do the following:
34
+
1. Open a PowerShell prompt as an administrator.
35
+
2. Disable the sync scheduler after verifying that no synchronization operations are running:
38
36
39
-
1. Open a PowerShell prompt as administrator.
40
-
2. Disable the sync scheduler after verifying that no synchronization operations are running:
41
-
```PowerShell
42
-
Set-ADSyncScheduler -SyncCycleEnabled $false
43
-
```
37
+
```PowerShell
38
+
Set-ADSyncScheduler -SyncCycleEnabled $false
39
+
```
44
40
3. Import the ADSync module:
45
-
```PowerShell
46
-
Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync\ADSync.psd1'
47
-
```
41
+
42
+
```PowerShell
43
+
Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync\ADSync.psd1'
44
+
```
48
45
4. Disable the group writeback feature for the tenant:
Group writeback is the feature that allows you to write cloud groups back to your on-premises Active Directory using Azure AD Connect Sync.
19
+
Group writeback is a feature that allows you to write cloud groups back to your on-premises Active Directory instance by using Azure Active Directory (Azure AD) Connect sync.
20
20
21
-
The following document will walk you through enabling group writeback.
21
+
This article walks you through enabling group writeback.
22
22
23
-
## Deployment Steps
23
+
## Deployment steps
24
24
25
-
Group writeback requires enabling both the original and new versions of the feature. If the original version was previously enabled in your environment, you will only need to follow the first set of steps, as the second set of steps has already been completed.
25
+
Group writeback requires enabling both the original and new versions of the feature. If the original version was previously enabled in your environment, you need to use only the first set of the following steps, because the second set of steps has already been completed.
26
26
27
-
>[!Note]
28
-
>It is recommended that you follow the [swing migration](how-to-upgrade-previous-version.md#swing-migration) method for rolling out the new group writeback feature in your environment. This method will provide a clear contingency plan in the event that a major rollback is necessary.
29
-
30
-
31
-
### Step 1 - Enable group writeback using PowerShell
32
-
33
-
1. On your Azure AD Connect server, open a PowerShell prompt as administrator.
34
-
2. Disable the sync scheduler after verifying that no synchronization operations are running.
35
-
36
-
```PowerShell
37
-
Set-ADSyncScheduler -SyncCycleEnabled $false
38
-
```
39
-
3. Import the ADSync module.
40
-
```PowerShell
41
-
Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync\ADSync.psd1'
42
-
```
43
-
4. Enable the group writeback feature for the tenant.
### Step 2 – Enable group writeback using Azure AD Connect wizard
53
-
If the original version of group writeback was not previously enabled, continue with the following steps.
54
-
27
+
> [!NOTE]
28
+
> We recommend that you follow the [swing migration](how-to-upgrade-previous-version.md#swing-migration) method for rolling out the new group writeback feature in your environment. This method will provide a clear contingency plan if a major rollback is necessary.
29
+
30
+
### Enable group writeback by using PowerShell
31
+
32
+
1. On your Azure AD Connect server, open a PowerShell prompt as an administrator.
33
+
2. Disable the sync scheduler after you verify that no synchronization operations are running:
34
+
35
+
```PowerShell
36
+
Set-ADSyncScheduler -SyncCycleEnabled $false
37
+
```
38
+
3. Import the ADSync module:
39
+
40
+
```PowerShell
41
+
Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync\ADSync.psd1'
42
+
```
43
+
4. Enable the group writeback feature for the tenant:
### Enable group writeback by using the Azure AD Connect wizard
55
+
If the original version of group writeback was not previously enabled, continue with the following steps:
56
+
57
+
1. On your Azure AD Connect server, open the Azure AD Connect wizard.
58
+
2. Select **Configure**, and then select **Next**.
59
+
3. Select **Customize synchronization options**, and then select **Next**.
60
+
4. On the **Connect to Azure AD** page, enter your credentials. Select **Next**.
61
+
5. On the **Optional features** page, verify that the options you previously configured are still selected.
62
+
6. Select **Group Writeback**, and then select **Next**.
63
+
7. On the **Writeback** page, select an Active Directory organizational unit (OU) to store objects that are synchronized from Microsoft 365 to your on-premises organization. Select **Next**.
64
+
8. On the **Ready to configure** page, select **Configure**.
65
+
9. On the **Configuration complete** page, select **Exit**.
66
+
67
+
After you finish this procedure, group writeback is configured automatically. If you experience permission issues while exporting the object to Active Directory, open Windows PowerShell as an administrator on the Azure AD Connect server. Then run the following commands. This step is optional.
55
68
56
-
57
-
1. On your Azure AD Connect server, open the Azure AD Connect wizard, select **Configure** and then click **Next**.
58
-
2. Select **Customize synchronization options** and then click **Next**.
59
-
3. On the **Connect to Azure AD page**, enter your credentials. Click **Next**.
60
-
4. On the **Optional features** page, verify that the options you previously configured are still selected.
61
-
5. Select **Group Writeback** and then click **Next**.
62
-
6. On the **Writeback page**, select an Active Directory organizational unit (OU) to store objects that are synchronized from Microsoft 365 to your on-premises organization, and then click **Next**.
63
-
7. On the **Ready to configure page**, click **Configure**.
64
-
8. When the wizard is complete, click **Exit** on the Configuration complete page. Group Writeback will be automatically configured.
65
-
66
-
>[!Note]
67
-
>The following is performed automatically after the last step above. However, if you experience permission issues while exporting the object to AD then do the following:
68
-
>
69
-
>Open the Windows PowerShell as an Administrator on the Azure Active Directory Connect server, and run the following commands. This step is optional
To make it easier to find groups being written back from Azure AD to Active Directory, there's an option to write back the group distinguished name with the cloud display name.
83
+
To make it easier to find groups being written back from Azure AD to Active Directory, there's an option to write back the group distinguished name by using the cloud display name:
When configuring group writeback, there will be a checkbox at the bottom of the Group Writeback configuration window. Select the box to enable this feature.
91
+
When you're configuring group writeback, a checkbox appears at the bottom of the configuration window. Select it to enable this feature.
96
92
97
-
>[!NOTE]
98
-
>Groups being written back from Azure AD to AD will have a source of authority of the cloud. This means any changes made on-premises to groups that are written back from Azure AD will be overwritten on the next sync cycle.
93
+
>[!NOTE]
94
+
>Groups being written back from Azure AD to Active Directory will have a source of authority in the cloud. Any changes made on-premises to groups that are written back from Azure AD will be overwritten in the next sync cycle.
99
95
100
-
## Next steps:
96
+
## Next steps
101
97
102
98
-[Azure AD Connect group writeback](how-to-connect-group-writeback-v2.md)
103
99
-[Modify Azure AD Connect group writeback default behavior](how-to-connect-modify-group-writeback.md)
104
100
-[Disable Azure AD Connect group writeback](how-to-connect-group-writeback-disable.md)
0 commit comments