Group source of authority moves synced AD groups under cloud control

In a lot of the tenants I review, I keep finding groups that were created in Active Directory but are now used only for cloud scenarios: distribution lists in Exchange Online, security groups for SharePoint, Teams or SaaS apps, sometimes even access control for Conditional Access or Copilot. Until recently, if you wanted to stop treating Active Directory as the source of authority for groups, you had two bad options. Either you kept managing the groups on-premises (and duplicated every change), or you deleted them and rebuilt them in Entra ID, with the risk of losing memberships, mail addresses and role assignments. For many organizations working toward a cloud-only identity model, that was a serious obstacle. Since the group source of authority (SOA) switch arrived in Entra ID (previewed in 2025), there is finally a practical and low-risk way to turn synced groups into real cloud-managed objects. Because it's a preview, check the current official docs for details and supported scenarios.

The SOA switch moves group management into the cloud without recreating anything

With the SOA switch, a few clicks are enough to convert a synced AD group into a cloud-managed group. You don't recreate anything and you don't migrate anything by hand. The group keeps its object ID, its mail addresses and all existing permissions and assignments (Teams, SharePoint, role assignments). After the switch, though, memberships, attributes and names are managed only in the cloud. The group's source now reads "Cloud", and Entra ID ignores whatever you change in AD from that point on. So you can retire your AD-centric processes, or at the very least stop worrying that an accidental on-prem change will overwrite your cloud configuration.

In my projects this pays off most with legacy distribution groups, security groups that only exist for cloud apps or SaaS access, and old mail-enabled groups nobody needs on-prem anymore. It also helps organizations that want to modernize at their own pace and reduce their hybrid dependency step by step, without breaking access or losing the group's history. Be clear about one thing, though. The moment you switch the source to cloud, the link to AD is gone. There are no more automatic updates from on-prem, and legacy tools that read directly from AD won't see new changes.

Most switches involve cloud-only groups, and hidden AD dependencies cause the trouble

These are the use cases I run into most often for the group source of authority switch:

• Distribution lists that came from Exchange on-prem but now only serve Exchange Online
• Security groups that control SaaS or Microsoft 365 resources and aren't needed locally anymore
• Groups that HR or old automation scripts used to manage in AD
• Old hybrid groups that need cleaning up before Active Directory is decommissioned

Problems start when apps, scripts or onboarding workflows still pull group membership from AD. Map those dependencies first. They often sit in custom scripts or third-party tools where nobody thinks to look. Also keep in mind that dynamic AD groups (where rules calculate the membership) aren't supported yet. The switch works for static groups only.

The switch requires current sync tools and works only for static groups

You need a recent version of Entra Connect Sync or Cloud Sync to use the group source of authority switch. The minimum supported version depends on the current announcement (see the docs), so verify it before you plan the migration. If your environment is eligible, the feature shows up in the Entra portal. In practice, many tenants have to update their sync tools first, and that step is easy to miss. Supported are only groups that are currently synced static groups (distribution or security). Dynamic AD groups remain excluded.

If the group still has to exist in AD, for legacy apps or backup scenarios, Cloud Sync provides membership writeback. After the SOA switch, membership changes you make in Entra ID can be written back to the on-prem group. You manage the group in the cloud, and AD-based tools still see current membership. This requires Cloud Sync configured for writeback and an AD connector with the right permissions.

One tip from my own experience:

Before you switch a group's source, look for automation, apps or workflows that still read group membership directly from AD. These dependencies are often undocumented, so ask your colleagues in application support and take a quick look at the AD change logs to avoid surprises.

The original AD group stays in place but stops syncing

In workshops, people almost always ask what becomes of the original group in AD. After the SOA switch, the AD group is still there but no longer synced, and Entra ID ignores changes made to it in AD. If you turn on membership writeback, the cloud group overwrites the local membership to keep both in line. If you don't need the AD group anymore, you can delete it once you've confirmed everything works in the cloud. For compliance and recovery, I always document the change and watch for applications or scripts that might still expect an active AD group.

To check a group's SOA status, go to the Entra portal → Groups and filter by 'Source'. After the switch the source shows 'Cloud', but the object ID stays the same, so all permissions, mail addresses and resource links remain intact.

A simple diagram shows the migration path

This diagram shows how an AD group goes through the SOA switch, including the optional membership writeback:

flowchart TD
    ADGroup["AD group"] --> Sync["Sync"]
    Sync --> EntraGroup["Entra ID group (Source: AD)"]
    EntraGroup --> SOASwitch["SOA switch"]
    SOASwitch --> CloudManaged["Entra ID group (Source: Cloud)"]
    CloudManaged -->|optional| Writeback["Membership writeback (Cloud Sync)"]
    Writeback --> ADGroup["AD group (membership only)"]

Figure: Group source of authority switch and writeback path

I consider the switch a real step forward for cloud-first group management

If you're serious about reducing your dependency on Active Directory, the group source of authority switch fills the gap that was missing. You keep your existing group objects, skip the risky rebuild and move control into Entra ID without breaking permissions, mail addresses or resource links. Where legacy apps still need group membership on-prem, Cloud Sync writeback covers that. As with any preview feature, behavior and requirements can change with the current announcement, so watch the docs and the Message Center. From what I've seen, now is a good time for many tenants to plan their group source of authority transition and hand group management over to the cloud for good.