

There are a few activities that you'll want to complete before enabling the latest public preview of group writeback. The following document will walk you through what you need to know before you enable group writeback for your tenant. or later and must be enabled in addition to the original version. The new version is only available in the Azure AD Connect version 2.0.89.0 or later. The Azure AD Admin portal, Graph Explorer, and PowerShell can be used to configure which Azure AD groups are written back.The common name in an Active Directory group’s distinguished name can be configured to include the group’s display name when written back.Azure AD registered and Azure AD Joined devices require device writeback to be enabled for group membership to be written back. Devices that are members of writeback enabled groups in Azure AD, will be written back as members to AD.Written back groups nested as members of on-premises AD synced groups will be synced up to Azure AD as nested.Group nesting in Azure AD will be written back if both groups exist in AD.Directory settings can be configured to control whether newly created Microsoft 365 groups are written back by default.Groups with assigned and dynamic memberships can be written back.All groups are written back with a group scope of universal.Azure AD Security groups can be written back as Security groups.Microsoft 365 groups can be written back as Distribution groups, Security groups, or Mail-Enabled Security groups.The new, expanded version of group writeback is in public preview and enables the following capabilities: The original version is in general availability and is limited to writing back Microsoft 365 groups to your on-premises Active Directory as distribution groups. There are two versions of group writeback. This feature enables you to manage groups in the cloud, while controlling access to on-premises applications and resources. Group writeback allows you to write cloud groups back to your on-premises Active Directory using Azure AD Connect Sync.
