Question

Contoso synchronizes its on-premises Active Directory to Microsoft Entra ID using Microsoft Entra Connect. The identity team creates and manages cloud security groups in Entra ID for SaaS app access. However, several legacy on-premises file shares grant permissions based on AD security groups only. Contoso wants users assigned to cloud-managed Entra groups to automatically gain access to these on-premises file shares without manually recreating groups in AD. Which solution should you recommend?

Accepted Answer

Enable group writeback in Microsoft Entra Connect so that cloud security groups are provisioned back into on-premises Active Directory.

Answer

Configure password hash synchronization and seamless single sign-on to extend cloud group membership to on-premises resources.

Answer

Deploy Microsoft Entra Domain Services and join the file servers to the managed domain to consume cloud groups directly.

Answer

Use Microsoft Entra entitlement management access packages to assign the on-premises file share permissions automatically.