Microsoft Releases New Azure AD Group Writeback Updates

Cloud Computing

Microsoft has recently announced some important updates for Azure AD Connect Group Writeback. This release enables organizations to write back Microsoft 365 groups (assigned & dynamic) to their on-premises Active Directory as a security group, mail-enabled security group, or distribution list.

For those unfamiliar, Group Writeback is a useful tool that enables IT Pros to use the Azure AD Connect Sync client for synchronizing cloud groups with on-premises environments. It makes it easier to manage cloud groups as well as control access to on-premises resources and apps.

Up until now, the Group Writeback feature only allowed IT admins to write Microsoft 365 groups as universal distribution on-premises Active Directory. It was primarily used for keeping Exchange Online Address Lists and Address Books up to date. However, this is about to change now.

“With this public preview, we’ve expanded what groups can be written back, added the ability to manage groups for writeback in MS Graph and the Azure Admin Portal, and added a feature in Azure AD Connect to make it easier to find your groups on-prem,” Microsoft explained.

Azure AD Connect adds new group writeback features

Microsoft has also made it possible to write Azure Active Directory (AD) security groups (assigned and dynamic) as a security group. Furthermore, customers can decide for each group whether it should be written back into the on-premises environment.

It is important to note that the new Group Writeback enhancements are available tenant-wide, rather than per Azure Active Directory Connect server. Additionally, IT admins will need to install Azure AD Connect version ( or later to get the latest update. If you haven’t done it yet, you can check out this support document to enable the feature.

Microsoft says that older Azure AD Connect builds lack support for the new version of Group Writeback. If the previous Group Writeback experience is already enabled in your tenant, Azure AD Connect will continue to write back all Microsoft 365 groups as Distribution lists (without Azure AD security groups).