Entra Group Source of Authority CONVERSION!

Key Concepts

• Source of Authority (SOA): The system or set of systems considered the "source of truth" for a digital identity object, where changes should be made.
• Entra ID (formerly Azure AD): Microsoft's cloud-based identity and access management service.
• Active Directory Domain Services (AD DS): The on-premises directory service that stores information about objects in a domain.
• Entra Connect/Cloud Sync: Tools to synchronize objects between AD DS and Entra ID. Cloud Sync is newer and more lightweight, with orchestration in the cloud.
• Group Writeback: A feature (requires Entra ID P1 or above) that writes security groups created in Entra ID back to AD DS as universal groups (non-mail enabled only).
• Graph Explorer: A tool for interacting with the Microsoft Graph API to manage Entra ID resources.
• IsCloudManaged: An attribute on group objects that indicates whether the source of authority is Entra ID (true) or AD DS (false).
• Dynamic Groups: Groups in Entra ID whose membership is determined by rules based on user attributes.
• Access Packages: Part of Entitlement Management, allowing bundles of group memberships and resource access to be granted with time limits and approval workflows.
• Access Reviews: Periodic reviews of group memberships to ensure users still require access.
• Privileged Identity Management (PIM): Granting elevated access to groups or roles only when needed.
• Scream Test: A method of identifying dependencies on on-premises Active Directory groups by disabling them and observing who complains.

Active Directory and Entra ID: A Historical Perspective

The video starts by outlining the evolution of identity management, beginning with on-premises Active Directory Domain Services (AD DS). In this model, AD DS was the sole source of authority (SOA) for digital objects like users, computers, and groups. With the rise of cloud services, Entra ID (formerly Azure AD) emerged as a cloud identity provider.

To integrate on-premises AD with Entra ID, Microsoft introduced Entra Connect, which has two flavors: Connect Sync (the legacy version with the replication engine on-premises) and Cloud Sync (the newer, lighter-weight version with the replication engine in the cloud). However, even with synchronization, AD DS remained the SOA for objects replicated to Entra ID. This created limitations, as changes to synchronized objects could primarily only be made in AD DS.

Example: If a user "Barry Allen" is synced from AD DS to Entra ID, his properties in Entra ID are read-only because AD DS is his SOA.

Challenges of AD DS as the Sole Source of Authority

The speaker highlights the increasing shift towards cloud-based services, where Entra ID offers richer identity, security, and integration capabilities. Features like dynamic groups, self-service group management, access packages, and access reviews are difficult or impossible to replicate with on-premises AD DS. Because groups drive access to the resources mostly, so rarely should grant identities direct access to resources, adding the identity to a group is more appropriate.

Quote: "...as most organizations are shifting those key capabilities to be cloud-based, I want more of the abilities that I could capitalize on from the cloud."

Group Writeback: A Partial Solution

The video then introduces Group Writeback as a partial solution to this problem. Group Writeback, which requires Entra ID P1 licensing and Cloud Sync, allows security groups created directly in Entra ID to be written back to AD DS as universal groups. This enables organizations to leverage Entra ID's advanced group features while maintaining group membership in AD DS for legacy applications.

Requirement: Group Writeback only works for non-mail enabled security groups.

Example: Creating a "Justice League" group in Entra ID with dynamic membership rules and writing it back to AD DS. Members who are cloud-only users will not be included in the on-premises group.

The New Group Source of Authority Conversion Capability

The core of the video focuses on the newly released capability to change the source of authority (SOA) for existing groups from AD DS to Entra ID. This allows organizations to manage groups primarily in the cloud, taking advantage of Entra ID's features, even if those groups originated in AD DS. The speaker emphasizes the importance of hygiene: organizations should audit and clean up their existing groups before migrating their SOA.

A Step-by-Step Decision Process

The video outlines a decision-making process for each group when considering the SOA switch:

1. Is it still needed? If not, delete it.
2. Is it needed in the cloud? If so, plan to flip the SOA to Entra ID.
3. Is it still needed in Active Directory?
   • If not, delete it from AD DS after flipping the SOA.
   • If yes, and it's a non-mail enabled security group, add it to the scope of Group Writeback.

Technical Implementation: Using Graph Explorer

The video provides a step-by-step guide on how to use Microsoft Graph Explorer to switch the SOA for a group:

1. Ensure the latest version of Entra Connect Sync client is installed.
2. Grant Permissions: In Graph Explorer, consent to the Group.ReadWrite.All permission and the Group.OnPremisesSyncBehavior.ReadWrite.All delegated permission.
3. Get the Group's Object ID: Find the object ID of the group you want to migrate.
4. Query the isCloudManaged Property: Use a GET request to query the isCloudManaged property of the group object. The initial value will be false.
5. Change the API Version to Beta: Change the API version to beta for the subsequent steps.
6. Patch the isCloudManaged Property: Use a PATCH request to set the isCloudManaged property to true. The request body should contain:

   {
     "isCloudManaged": true
   }
   

7. Verify the Change: Use a GET request to confirm that the isCloudManaged property is now true.

Once the isCloudManaged attribute is set to true, Entra ID becomes the source of authority for that group. This unlocks the ability to manage the group's properties, membership, and ownership directly in Entra ID.

Example: After switching the SOA for the "Justice League" group, the speaker can now add an owner ("Clark Kent") and modify membership rules in Entra ID. The change is logged in the Entra ID audit logs.

Post-Migration Steps and Considerations

After switching the SOA, the video recommends the following steps:

1. Set an Owner: Ensure the group has an appropriate owner in Entra ID.
2. Enable Self-Service Capabilities: Configure self-service group management options.
3. Delete from AD DS (if no longer needed): If the group is no longer required in AD DS, remove it to simplify on-premises infrastructure.
4. Add to Group Writeback (if needed in AD DS): If the group is still needed in AD DS and meets the requirements (non-mail enabled security group), add it to the scope of Group Writeback.

The video also discusses the impact on HR systems. As the SOA shifts to Entra ID, HR systems should be configured to directly update user and group information in Entra ID, rather than relying on synchronization from AD DS.

Importance of Testing and the "Scream Test"

The video emphasizes the importance of thorough testing before and after migrating a group's SOA. The Microsoft documentation suggests a "scream test," which involves disabling aspects of the group's usage and monitoring for complaints. This helps identify hidden dependencies on the on-premises group.

Quote: "...basically what you're going to do is break it and see who yells and cries because you may not know...the only way we can really tell is we start disabling aspects of the group's usage and see who complains at you."

Future Roadmap: User SOA Switch and Rightback

The video concludes by mentioning that the ability to switch the SOA for users and enable user writeback is not yet available, but is likely to be added in the future. The group SOA switch is a significant step towards the ultimate goal of shifting identity management from AD DS to Entra ID.

Conclusion

The ability to change the source of authority for groups in Entra ID represents a significant advancement in hybrid identity management. It allows organizations to embrace the rich capabilities of Entra ID while gradually reducing their reliance on on-premises Active Directory. The video provides a comprehensive overview of the new feature, including the necessary steps for implementation, key considerations, and future roadmap. By carefully planning and executing the SOA switch, organizations can simplify their identity infrastructure, improve security, and empower their users with self-service capabilities.