Merge pull request #106765 from iainfoulds/patch-1

[AzureADDS] Update group membership change FAQ entry

Author: PRMerger15

articles/active-directory-domain-services/faqs.md

@@ -93,7 +93,7 @@ Any user account that's part of the Azure AD DS managed domain can join a VM. Me
 No. You aren't granted administrative privileges on the managed domain. *Domain Administrator* and *Enterprise Administrator* privileges aren't available for you to use within the domain. Members of the domain administrator or enterprise administrator groups in your on-premises Active Directory are also not granted domain / enterprise administrator privileges on the managed domain.
 
 ### Can I modify group memberships using LDAP or other AD administrative tools on managed domains?
-No. Group memberships can't be modified on domains serviced by Azure AD Domain Services. The same applies for user attributes. You can change group memberships or user attributes either in Azure AD or on your on-premises domain. Changes are automatically synchronized to Azure AD Domain Services.
+Users and groups that are synchronized from Azure Active Directory to Azure AD Domain Services cannot be modified because their source of origin is Azure Active Directory. Any user or group originating in the managed domain may be modified.
 
 ### How long does it take for changes I make to my Azure AD directory to be visible in my managed domain?
 Changes made in your Azure AD directory using either the Azure AD UI or PowerShell are automatically synchronized to your managed domain. This synchronization process runs in the background. There's no defined time period for this synchronization to complete all the object changes.