Entra Connect is Microsoft's synchronization service between on-premises Active Directory and Entra ID: users and groups mastered on-premises are projected into the cloud tenant. In hybrid organizations, a large share of the group structure you see in Entra ID was born somewhere else.
What synced means operationally#
Synced objects follow the source-of-authority rule:
- Synced groups are managed on-premises; their membership cannot be edited in the cloud portal.
- Cloud-created groups live alongside them, managed in Entra ID directly.
- Structure spans both: cloud groups can contain synced groups and the reverse, so effective access crosses the boundary invisibly.
Why hybrid structure is harder to reason about#
Every structural question now has a second dimension: not just what the hierarchy is, but where each piece is managed and therefore where it must be fixed. A cleanup plan that ignores source of authority produces changes that sync promptly overwrites.
VisualizerEngine
Hybrid structure in VisualizerEngine
The mirror reads the tenant as Entra ID sees it, synced and cloud groups together, so the combined structure, which is what actually grants access, is visible as one hierarchy. Structural search and saved searches keep the which-groups-are-synced dimension queryable during cleanups.