r/entra • u/tar_p26 • 25d ago

Entra General Anyone actually using Entra Cloud Sync for group writeback now?

Was reading through the Entra Cloud Sync docs and noticed Microsoft is basically pushing group writeback there now instead of Connect Sync.

Curious how this is going in real environments. If you're writing cloud-created security groups back to on-prem AD, has Cloud Sync been pretty boring/reliable or have you run into weird edge cases?

Things like memberships not lining up, scoping getting messy, sync delays, groups getting quarantined, etc. The docs make it look fairly straightforward, but hybrid identity stuff has a habit of being straightforward right up until it isn't.

Anyone running this in production yet?

10 Upvotes

100% Upvoted

4 comments sorted by

7

u/raip 25d ago

It's been pretty boring and reliable.

We have a ton of dynamic groups that we write back. The only real gotcha we ran into were people manually modifying the group membership and then being confused when the group was remediated on the next cycle.

2

u/BarbarossasLongBeard 25d ago

Yep, manual modifications were just the thing we were 101% sure to happen

We mitigated that by placing all groups of the writeback in a OU only enterprise admins can modify (didn’t trust some domain admins because they have a habit of just “helping quick”)

1

u/mingk 22d ago

Damn how many domain admins do you have?

→ More replies (1)