Skip to content

Commit d83d4d3

Browse files
ttorblettorble
authored
Merge pull request #207948 from MicrosoftDocs/main
Merge main to live, 4 AM
2 parents b6f96bb + 23ee98c commit d83d4d3

File tree

67 files changed

+1268
-333
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+1268
-333
lines changed

‎articles/active-directory/governance/entitlement-management-access-package-first.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@ To set up group writeback for Microsoft 365 groups in access packages, you must
262262

263263
- Set up group writeback in the Azure Active Directory admin center.
264264
- The Organizational Unit (OU) that will be used to set up group writeback in Azure AD Connect Configuration.
265-
- Complete the [group writeback enablement steps](../hybrid/how-to-connect-group-writeback-v2.md#enable-group-writeback-using-azure-ad-connect) for Azure AD Connect.
265+
- Complete the [group writeback enablement steps](../hybrid/how-to-connect-group-writeback-enable.md) for Azure AD Connect.
266266

267267
Using group writeback, you can now sync Microsoft 365 groups that are part of access packages to on-premises Active Directory. To sync the groups, follow the steps below:
268268

‎articles/active-directory/hybrid/TOC.yml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -197,8 +197,14 @@
197197
items:
198198
- name: Enable device writeback
199199
href: how-to-connect-device-writeback.md
200-
- name: Enable group writeback
200+
- name: Plan for group writeback
201201
href: how-to-connect-group-writeback-v2.md
202+
- name: Enable group writeback
203+
href: how-to-connect-group-writeback-enable.md
204+
- name: Modify group writeback
205+
href: how-to-connect-modify-group-writeback.md
206+
- name: Disable group writeback
207+
href: how-to-connect-group-writeback-disable.md
202208
- name: Device options
203209
href: how-to-connect-device-options.md
204210
- name: Additional features in Azure AD Connect

‎articles/active-directory/hybrid/how-to-connect-group-writeback-disable.md

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
title: 'Disable group writeback in Azure AD Connect'
3+
description: This article describes how to disable Group Writeback in Azure AD Connect.
4+
services: active-directory
5+
author: billmath
6+
manager: karenhoran
7+
ms.service: active-directory
8+
ms.topic: how-to
9+
ms.workload: identity
10+
ms.date: 06/15/2022
11+
ms.subservice: hybrid
12+
ms.author: billmath
13+
14+
ms.collection: M365-identity-device-management
15+
---
16+
17+
# Disabling group writeback
18+
The following document will walk you thorough disabling group writeback. To disable group writeback for your organization, use the following steps:
19+
20+
1. Launch the Azure Active Directory Connect wizard and navigate to the Additional Tasks page. Select the Customize synchronization options task and click next.
21+
2. On the Optional Features page, uncheck group writeback. You'll receive a warning letting you know that groups will be deleted. Click Yes.
22+
>[!Important]
23+
>Disabling Group Writeback will cause any groups that were previously created by this feature to be deleted from your local Active Directory on the next synchronization cycle.
24+
25+
3. Uncheck the box
26+
4. Click Next.
27+
5. Click Configure.
28+
29+
30+
>[!Note]
31+
>Disabling Group Writeback will set the Full Import and Full Synchronization flags to 'true' on the Azure Active Directory Connector, causing the rule changes to propagate through on the next synchronization cycle, deleting the groups that were previously written back to your Active Directory.
32+
33+
34+
35+
## Rolling back group writeback
36+
37+
To disable or roll back group writeback via PowerShell, do the following:
38+
39+
1. Open a PowerShell prompt as administrator.
40+
2. Disable the sync scheduler after verifying that no synchronization operations are running:
41+
``` PowerShell
42+
Set-ADSyncScheduler -SyncCycleEnabled $false
43+
```
44+
3. Import the ADSync module:
45+
``` PowerShell
46+
Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync\ADSync.psd1'
47+
```
48+
4. Disable the group writeback feature for the tenant:
49+
``` PowerShell
50+
Set-ADSyncAADCompanyFeature -GroupWritebackV2 $false
51+
```
52+
5. Re-enable the Sync Scheduler
53+
``` PowerShell
54+
Set-ADSyncScheduler -SyncCycleEnabled $true
55+
```
56+
57+
58+
## Next Steps:
59+
60+
- [Azure AD Connect group writeback](how-to-connect-group-writeback-v2.md)
61+
- [Modify Azure AD Connect group writeback default behavior](how-to-connect-modify-group-writeback.md)
62+
- [Enable Azure AD Connect group writeback](how-to-connect-group-writeback-enable.md)
63+

‎articles/active-directory/hybrid/how-to-connect-group-writeback-enable.md

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
---
2+
title: 'Enable Azure AD Connect group writeback'
3+
description: This article describes how to enable Group Writeback in Azure AD Connect.
4+
services: active-directory
5+
author: billmath
6+
manager: karenhoran
7+
ms.service: active-directory
8+
ms.topic: how-to
9+
ms.workload: identity
10+
ms.date: 06/15/2022
11+
ms.subservice: hybrid
12+
ms.author: billmath
13+
14+
ms.collection: M365-identity-device-management
15+
---
16+
17+
# Enable Azure AD Connect group writeback
18+
19+
Group writeback is the feature that allows you to write cloud groups back to your on-premises Active Directory using Azure AD Connect Sync.
20+
21+
The following document will walk you through enabling group writeback.
22+
23+
## Deployment Steps
24+
25+
Group writeback requires enabling both the original and new versions of the feature. If the original version was previously enabled in your environment, you will only need to follow the first set of steps, as the second set of steps has already been completed.
26+
27+
>[!Note]
28+
>It is recommended that you follow the [swing migration](how-to-upgrade-previous-version.md#swing-migration) method for rolling out the new group writeback feature in your environment. This method will provide a clear contingency plan in the event that a major rollback is necessary.
29+
30+
31+
### Step 1 - Enable group writeback using PowerShell
32+
33+
1. On your Azure AD Connect server, open a PowerShell prompt as administrator.
34+
2. Disable the sync scheduler after verifying that no synchronization operations are running.
35+
36+
``` PowerShell
37+
Set-ADSyncScheduler -SyncCycleEnabled $false
38+
```
39+
3. Import the ADSync module.
40+
``` PowerShell
41+
Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync\ADSync.psd1'
42+
```
43+
4. Enable the group writeback feature for the tenant.
44+
``` PowerShell
45+
Set-ADSyncAADCompanyFeature -GroupWritebackV2 $true
46+
```
47+
5. Re-enable the Sync Scheduler.
48+
``` PowerShell
49+
Set-ADSyncScheduler -SyncCycleEnabled $true
50+
```
51+
52+
### Step 2 – Enable group writeback using Azure AD Connect wizard
53+
If the original version of group writeback was not previously enabled, continue with the following steps.
54+
55+
56+
57+
1. On your Azure AD Connect server, open the Azure AD Connect wizard, select **Configure** and then click **Next**.
58+
2. Select **Customize synchronization options** and then click **Next**.
59+
3. On the **Connect to Azure AD page**, enter your credentials. Click **Next**.
60+
4. On the **Optional features** page, verify that the options you previously configured are still selected.
61+
5. Select **Group Writeback** and then click **Next**.
62+
6. On the **Writeback page**, select an Active Directory organizational unit (OU) to store objects that are synchronized from Microsoft 365 to your on-premises organization, and then click **Next**.
63+
7. On the **Ready to configure page**, click **Configure**.
64+
8. When the wizard is complete, click **Exit** on the Configuration complete page. Group Writeback will be automatically configured.
65+
66+
>[!Note]
67+
>The following is performed automatically after the last step above. However, if you experience permission issues while exporting the object to AD then do the following:
68+
>
69+
>Open the Windows PowerShell as an Administrator on the Azure Active Directory Connect server, and run the following commands. This step is optional
70+
>
71+
>``` PowerShell
72+
>$AzureADConnectSWritebackAccountDN = <MSOL_ account DN>
73+
>Import-Module "C:\Program Files\Microsoft Azure Active Directory Connect\AdSyncConfig\AdSyncConfig.psm1"
74+
>
75+
># To grant the <MSOL_account> permission to all domains in the forest:
76+
>Set-ADSyncUnifiedGroupWritebackPermissions -ADConnectorAccountDN $AzureADConnectSWritebackAccountDN
77+
>
78+
># To grant the <MSOL_account> permission to specific OU (eg. the OU chosen to writeback Office 365 Groups to):
79+
>$GroupWritebackOU = <DN of OU where groups are to be written back to>
80+
>Set-ADSyncUnifiedGroupWritebackPermissions –ADConnectorAccountDN $AzureADConnectSWritebackAccountDN -ADObjectDN $GroupWritebackOU
81+
>```
82+
83+
84+
85+
## Optional configuration
86+
87+
To make it easier to find groups being written back from Azure AD to Active Directory, there's an option to write back the group distinguished name with the cloud display name.
88+
89+
- Default format:
90+
CN=Group_3a5c3221-c465-48c0-95b8-e9305786a271, OU=WritebackContainer, DC=domain, DC=com 
91+
92+
- New Format:
93+
CN=Administrators_e9305786a271, OU=WritebackContainer, DC=domain, DC=com 
94+
95+
When configuring group writeback, there will be a checkbox at the bottom of the Group Writeback configuration window. Select the box to enable this feature.
96+
97+
>[!NOTE]
98+
>Groups being written back from Azure AD to AD will have a source of authority of the cloud. This means any changes made on-premises to groups that are written back from Azure AD will be overwritten on the next sync cycle.
99+
100+
## Next steps:
101+
102+
- [Azure AD Connect group writeback](how-to-connect-group-writeback-v2.md)
103+
- [Modify Azure AD Connect group writeback default behavior](how-to-connect-modify-group-writeback.md)
104+
- [Disable Azure AD Connect group writeback](how-to-connect-group-writeback-disable.md)
105+
106+
107+
108+
109+
110+
111+
112+
113+
114+
115+
116+
117+
118+
119+
120+

0 commit comments

Comments
 (0)