An Issue Often Not Addressed<\/strong><\/p>\n\n\n\nThe July enforcement has broader implications for anyone running AD forest migrations, tenant-to-tenant migrations, or any workflow involving re-anchoring a synced identity.
There are important details to note:<\/p>\n\n\n\n
The July enforcement applies to all synced identities where a remap of OnPremisesObjectIdentifier is attempted, not only privileged users
It prevents setting OnPremisesObjectIdentifier to any value other than null, including what would previously have been a legitimate re-anchor operation. Soft match behaviour is not affected.<\/p>\n\n\n\n
Hard match takeover remains supported where the target cloud object has not already been mapped to a synced identity (where OnPremisesObjectIdentifier is currently empty). If you have a migration project in flight or planned for later this year, this timeline needs to be in your delivery schedule.<\/p>\n\n\n\n
\n\n\n\nWhat You Need to Do Before June 1<\/strong><\/p>\n\n\n\n1. Upgrade Entra Connect to a supported version<\/em><\/p>\n\n\n\nMicrosoft requires version 2.5.79.0 or later. This version is expected to become mandatory for continued sync operation by September 30, 2026. Verify the specific deadline against your Message Center notifications (MC1262584 and MC1263280), as Microsoft staggers enforcement by tenant.<\/p>\n\n\n\n
The installer is available exclusively from the Entra admin center under Microsoft Entra Connect, not from the Download Centre.<\/p>\n\n\n\n
2. Enable the hard match takeover block<\/em><\/p>\n\n\n\nConnect-Entra -Scopes 'OnPremDirectorySynchronization.ReadWrite.All'\nSet-EntraDirSyncFeature -Feature BlockCloudObjectTakeoverThroughHardMatch -Enabled $true<\/em><\/code><\/pre>\n\n\n\nVerify with:<\/p>\n\n\n\n
Get-EntraDirSyncFeature<\/code><\/pre>\n\n\n\nConfirm BlockCloudObjectTakeoverThroughHardMatch<\/code> shows True<\/code> in the Enabled<\/code> column.<\/p>\n\n\n\n3. Audit privileged cloud-managed accounts<\/em><\/p>\n\n\n\nIdentify cloud-managed accounts that hold Entra ID roles and have onPremisesImmutableId<\/code> populated. Query Microsoft Graph:<\/p>\n\n\n\nGET https:\/\/graph.microsoft.com\/v1.0\/users?$filter=onPremisesImmutableId ne null&$select=displayName,userPrincipalName,onPremisesImmutableId<\/code><\/pre>\n\n\n\nCross-reference against role assignments:<\/p>\n\n\n\n
GET https:\/\/graph.microsoft.com\/v1.0\/roleManagement\/directory\/roleAssignments?$expand=principal<\/code><\/pre>\n\n\n\nAny account appearing in both results needs review before June 1.<\/p>\n\n\n\n
\n\n\n\nWhat You Need to Do Before July 1<\/strong><\/p>\n\n\n\n4. Review audit logs for recent OnPremisesObjectIdentifier changes<\/em><\/p>\n\n\n\nIn the Entra admin centre, go to Monitoring \u2192 Audit logs and filter by Category: UserManagement and Activity: Update user. Look for modifications to OnPremisesObjectIdentifier<\/code> or DirSyncEnabled<\/code>. If you are routing logs to Sentinel:<\/p>\n\n\n\nAuditLogs\n| where OperationName == \"Update user\"\n| where TargetResources[0].modifiedProperties contains \"OnPremisesObjectIdentifier\"\n or TargetResources[0].modifiedProperties contains \"DirSyncEnabled\"\n| project TimeGenerated, InitiatedBy, TargetResources<\/code><\/pre>\n\n\n\nUnexpected modifications here should be treated as an indicator of compromise until proven otherwise.<\/p>\n\n\n\n
5. Update migration runbooks<\/em><\/p>\n\n\n\nAny workflow that assumes the ability to remap OnPremisesObjectIdentifier<\/code> will fail after July 1. The supported recovery path is below.<\/p>\n\n\n\n
\n\n\n\nLegitimate Recovery: The Graph API Path<\/strong><\/p>\n\n\n\nTo re-anchor a user after enforcement, clear OnPremisesObjectIdentifier<\/code> first, which makes the account eligible for a fresh hard match:<\/p>\n\n\n\nPATCH https:\/\/graph.microsoft.com\/beta\/users\/<UserId>\nContent-Type: application\/json\n\n{\n \"onPremisesObjectIdentifier\": null\n}<\/code><\/pre>\n\n\n\nThere are several caveats to this approach:<\/p>\n\n\n\n
\n- The caller must hold the Global Administrator or Hybrid Identity Administrator role<\/li>\n\n\n\n
- The required Graph permission is
User.ReadWrite.All<\/code><\/li>\n\n\n\n- The API only permits setting the value to null<\/li>\n\n\n\n
- For accounts with role assignments, all Entra ID roles must be temporarily removed before the hard match operation, then reassigned after sync completes<\/li>\n<\/ul>\n\n\n\n
Build the role removal and reassignment into your migration runbooks now. Discovering this requirement mid-cutover is not a pleasant experience.<\/p>\n\n\n\n
\n\n\n\nConclusion<\/strong><\/p>\n\n\n\nThe privileged account block on June 1 is the immediate priority. The July 1 remapping restriction is the one more likely to cause unexpected failures in migration projects, precisely because it affects a wider scope of objects and has received far less attention.<\/p>\n\n\n\n
The checklist: upgrade Connect, enable BlockCloudObjectTakeoverThroughHardMatch<\/code>, audit privileged accounts with populated onPremisesImmutableId<\/code>, review audit logs, and update migration runbooks to account for the Graph API recovery flow.<\/p>\n\n\n\nThis is something to keep in mind particularly if you are mid-way through an AD consolidation or tenant migration project, the window to complete hard match operations without hitting enforcement is shorter than it might appear.<\/p>\n","protected":false},"excerpt":{"rendered":"
Microsoft is enforcing two rounds of Entra Connect security hardening in June and July 2026. If you have an AD migration or re-anchoring project planned for this year, the July deadline is the one most likely to catch you off guard. This article covers the SyncJacking background, what both enforcement phases actually block, and the specific steps to take before each deadline, including the DirSync feature flag, audit log queries, and the Graph API recovery path for legitimate migration scenarios.<\/p>\n","protected":false},"author":1,"featured_media":3206,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sitemap_exclude":false,"_sitemap_priority":"","_sitemap_frequency":"","twitterCardType":"","cardImageID":0,"cardImage":"","cardTitle":"","cardDesc":"","cardImageAlt":"","cardPlayer":"","cardPlayerWidth":0,"cardPlayerHeight":0,"cardPlayerStream":"","cardPlayerCodec":"","footnotes":""},"categories":[850,753,867],"tags":[431,950,947,948,862,845,942,945,946,951,759,846,949,944,943],"class_list":["post-3204","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-850","category-microsoft365","category-microsoft-entra","tag-active-directory","tag-ad-migration","tag-cloud-sync","tag-directory-synchronization","tag-entra-connect","tag-entra-id","tag-hard-match","tag-hybrid-identity","tag-hybrid-identity-administrator","tag-identity-security","tag-microsoft-365","tag-microsoft-entra","tag-onpremisesimmutableid","tag-security-hardening","tag-syncjacking"],"_links":{"self":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts\/3204","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3204"}],"version-history":[{"count":1,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts\/3204\/revisions"}],"predecessor-version":[{"id":3208,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts\/3204\/revisions\/3208"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/media\/3206"}],"wp:attachment":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3204"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/modern-workplace.uk\/wp-content\/uploads\/2026\/04\/Copilot_20260408_130836.png\")
<\/a><\/figure>\n\n\n\n