🔹 Feature: Transfer User Source of Authority (SOA) From On-Prem AD to Microsoft Entra ID
🔹 What It Does: For decades, a synced hybrid user has been READ-ONLY in the cloud — every change had to flow through on-prem Active Directory. Microsoft Entra ID now lets you flip the script per user. Transfer that user’s Source of Authority to the cloud, and Entra ID becomes the master: changes happen in the cloud, on-prem AD changes no longer flow back. The cloud-first migration step the hybrid identity world was waiting for. ☁️🔄
What Is It Giving You:
✅ Per-User, Granular SoA Transfer: Flip individual users from “AD-mastered” to “cloud-mastered” with a single Microsoft Graph PATCH — isCloudManaged=true. No big-bang cutover, no domain controller decommission required. Migrate one user, one team, or one department at a time.
✅ Bidirectional and Reversible: Rolled back just as easily — set isCloudManaged=false and Connect Sync takes the object back over on its next cycle. Safety net included.
✅ Sync Engine Stays Aware: Once SoA is in the cloud, the Microsoft Entra connector sets blockOnPremisesSync=true on that object. AD changes for that user are recognized but not flowed (Event ID 6956 logged). No drift, no surprise overwrites.
✅ Full Audit Trail in Entra: Both the SoA change and any rollback show up as distinct activities in Audit Logs (“Change Source of Authority from AD to cloud” / “Undo changes…”). Compliance-friendly out of the box.
✅ Scope With Administrative Units: Delegate SoA operations to a Hybrid Identity Administrator scoped to an Administrative Unit — control which population a given admin can transfer.
✅ Contacts and Groups Too: User SoA, Contact SoA (Contacts-OnPremisesSyncBehavior.ReadWrite.All), and Group SoA all supported — clean migration paths for the whole identity hierarchy, not just users.
📋 Worth knowing before you flip:
🔸 Requires Microsoft Entra Free license — yes, this is free.
🔸 Connect Sync 2.5.76.0+ (2.5.79.0+ for Contacts), or Cloud Sync 1.1.1370.0+. Update your sync clients first.
🔸 Hybrid Administrator role required to call the Graph APIs; Application/Cloud Application Administrator to grant the User-OnPremisesSyncBehavior.ReadWrite.All permission.
🔸 If users still need on-prem resource access after SoA transfer, you must manually maintain the on-premises attributes (onPremisesSamAccountName, onPremisesSecurityIdentifier, etc.) via Graph — don’t delete them.
🔸 Before rollback, remove cloud-only references (group membership in cloud-mastered groups, access packages) so Connect Sync can cleanly take the object back.
For every enterprise stuck in “we’d love to be cloud-first but the synced users are read-only” — this is the unlock. 🚀
🌐 https://learn.microsoft.com/en-us/entra/identity/hybrid/how-to-user-source-of-authority-configure
