In hybrid tenants, part of the group structure is a projection: groups mastered in on-premises Active Directory and synchronized by Entra Connect. They grant access in the cloud like any group, but every change to them must happen at the source, and cleanup plans that forget this get overwritten by the next sync cycle.
The rules of hybrid structure#
Three facts prevent most hybrid frustration:
- Source of authority: synced groups are edited on-premises, and cloud-side edits are blocked or reverted.
- Mixed nesting: cloud and synced groups can nest across the boundary, so effective access routinely spans both worlds.
- Split remediation: fixing a structural defect means fixing it where its groups are mastered, sometimes in both places for one chain.
Planning changes across the boundary#
Any restructure in a hybrid tenant needs each affected group labeled with where it is managed, because the implementation plan splits into a cloud half and an on-premises half that must land in a coordinated order. Discovering the split mid-change is how hybrid cleanups stall.
VisualizerEngine
How VisualizerEngine helps
The mirror shows the tenant as Entra ID resolves it, synced and cloud groups in one hierarchy, which is the structure that actually grants access. Structural search keeps the where-is-it-managed dimension queryable, and simulation previews a cross-boundary change's consequences before the two-sided implementation begins.