What’s the best way to model an on-premises OU hierarchy in Entra ID?
Asked by
MellowCedar47
I'm a developer with limited Entra ID experience. A client currently imports users and departments from on-premises Active Directory by traversing every Organizational Unit and its users, then recreating that structure in a website. They want to move the integration to Entra ID using Microsoft Graph, but Entra ID doesn't provide the same tree-like OU structure. I've considered using each user's department attribute, but that seems error-prone. I've also seen the on-premises distinguished name mentioned as a possible way to identify a user's original OU. Does that value change when a user is moved to another OU, and what is the recommended way to represent or traverse this hierarchy in Entra ID?
Answers
Rather than trying to reproduce the OU tree, use attributes that are synchronized from your authoritative directory, assuming they’re maintained consistently. Another option is to create groups that represent the organizational hierarchy—for example, Directorate, Department, Unit, and Team—and have the website consume those group memberships through Microsoft Graph.
Reply to this answer
The cleaner approach is usually to treat the HR or organizational-management system as the source of truth, not Active Directory or Entra ID. That system should expose stable identifiers such as an organization ID and parent organization ID through an API or structured export. Build the website’s hierarchy from that data, then associate users with the appropriate organization instead of inferring structure from user attributes or distinguished names.
Reply to this answer
Directory synchronization features and password hash synchronization may help keep identities connected between environments, but they don’t recreate an OU hierarchy in Entra ID and don’t solve the organizational-structure modeling problem.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar47: That makes sense—synchronization keeps the identities aligned, but I still need a separate, reliable way to represent the organizational tree.