We have a Microsoft 365 environment using a hybrid-joined domain. Because of dependencies on our on-premises domain, we cannot move to a cloud-only setup in the foreseeable future. The on-premises Active Directory remains authoritative for basic user attributes such as names, email addresses, managers, and office locations.
We use several SaaS and Power Apps applications that integrate easily with Microsoft Entra ID and would ideally create or update these attributes directly. However, because the attributes are synchronized from on-premises Active Directory, the applications cannot use the same native cloud integration options.
How have others handled this type of setup? Are there third-party tools or supported provisioning methods that allow applications to update selected attributes in on-premises Active Directory, or is a custom PowerShell-based process the main option?
3 Answers
It would be worth reviewing whether all of these applications really need to update the directory. User attributes that change frequently may be better managed in a dedicated source system, with only the required values synchronized to Active Directory. Also, identify which legacy systems are forcing the on-premises dependency; if they only need LDAP or domain services, Entra Domain Services could potentially reduce the amount of on-premises directory management required.
There is also work underway on functionality that will let applications modify certain Entra ID attributes in hybrid environments, but the exact capabilities and rollout details may vary. In the meantime, API-driven provisioning or a controlled middleware process is probably more practical than allowing each application to update directory data independently.
Microsoft Entra API-driven inbound provisioning may work here. It allows an application or service to send user data into a provisioning endpoint, which can then write selected attributes back to on-premises Active Directory. That could provide a supported alternative to building separate scripts for every SaaS integration.
This approach works well for this kind of setup, as long as you carefully limit which attributes each application is allowed to change.