Domains and source of truth
- Destination domains and UPN suffixes verified
- Immutable-ID, matching, naming, and collision rules approved
- Entra Connect or Cloud Sync authority and sequencing documented
Microsoft Entra ID
Build the cloud identity target without creating anchor conflicts.
BridgeAD creates or updates supported users, groups, devices, and memberships through Microsoft Graph, checks immutable IDs and UPNs before user creation, and respects Entra Connect-owned attributes. Expansion workflows can invite B2B guests, recreate selected application definitions and service principals, and conditionally recreate selected Intune policy definitions.
Supported core Graph identity operationsUsers, groups, devices, and memberships are supported with configured application permissions. Guests and application definitions require manual governance and remediation. Intune configuration and compliance-policy definitions use conditional Graph beta endpoints.
Operator experience
Resolve target authority before object creation.
Operators configure Graph connections, validate tenant and application credentials, approve source-to-target mapping rules, identify immutable-ID and UPN collisions, select expansion objects, and review created, updated, skipped, and failed outcomes.
- Tenant, client credential, secret reference, and active-connection validation
- Immutable-ID checks before UPN fallback for users
- Update behavior that avoids overwriting Entra Connect-mastered users
- Idempotent group and device lookup by stable target property
- Selected B2B guest, application, service-principal, and Intune operations
- Source-to-target application ID maps and per-item failure reports
Entra ID / Target readinessRepresentative operational view
2,840Identities mapped
14Anchor conflicts
36Apps selected
Users and groupsImmutable IDs and UPN rules validated
ReadyB2B guestsRedemption and access review owner required
GovernIntune policiesGraph beta / assignments excluded
ConditionalIllustrative values; the interface displays customer-specific assessment data.
Capability scope
Apply a distinct acceptance test to each object family.
Creating a directory object is not equivalent to restoring its access, credentials, assignments, consent, enrollment, or lifecycle controls. BridgeAD reports object outcomes while the operating model assigns those dependent controls.
| Area | Status | BridgeAD handling | Important boundary |
|---|---|---|---|
| Users | Supported | Checks `onPremisesImmutableId` first, then UPN; reuses or updates safe matches and creates new users with supported attributes. | Hard-match conflicts are blocked. Most attributes on Entra Connect-mastered users remain owned by the synchronization authority. |
| Groups | Supported | Resolves groups by mail nickname, then creates or updates supported display, description, mail, and security settings. | Dynamic rules, role-assignable behavior, licensing, and application-specific group use require separate validation. |
| Group membership | Supported | Adds mapped destination directory objects to resolved destination groups through Microsoft Graph. | Nested behavior, privileged groups, access packages, and application authorization must be reviewed. |
| Device directory records | Supported object | Creates or updates device directory records using the stable device ID and supported operating-system and enabled properties. | A directory record is not device enrollment, join, registration, compliance, certificate, profile, or application migration. |
| B2B guests | Supported + governance | Discovers or selects guests, skips existing destination matches, sends or suppresses invitations, and reports failures. | Redemption, access reviews, group and app assignments, entitlement, and cross-tenant trust remain administrator owned. |
| App registrations | Supported + remediation | Recreates selected application definitions, including supported web, SPA, public-client, API, required-resource, optional-claim, and tag configuration, and records new application IDs. | Secrets, certificates, consent grants, owners, assignments, and external integration references must be replaced or re-approved. |
| Service principals | Optional creation | Can create a destination service principal for a newly recreated selected application. | Enterprise-app assignments, conditional access impact, delegated/application consent, provisioning, and credentials are not copied. |
| Intune policy definitions | Conditional beta | Recreates selected device-configuration and device-compliance policy definitions using Microsoft Graph beta and reports each outcome. | Beta behavior can change. Assignments, scope tags, enrollment, certificates, scripts, apps, and device state are not implied. |
Prerequisites
Approve authority, consent, and collision rules first.
The destination tenant must be able to distinguish cloud-owned from synchronized attributes and must grant only the Graph permissions required for the selected operations.
Application and consent
- Source read and destination write permissions selected per scope
- Tenant IDs, client IDs, and secret references validated
- Admin consent, secret rotation, and audit owners assigned
Licensing and governance
- Licenses, privileged roles, Conditional Access, and MFA readiness reviewed
- Guest redemption, application consent, and device owners named
- Rollback and remediation actions defined per object family
Migration workflow
Create the identity foundation before dependent workloads.
Exchange, SharePoint, OneDrive, Teams, and application access all depend on stable destination identities and groups. Application and device expansion should follow explicit selections and separate acceptance criteria.
Connect
Configure source and destination Graph applications, secret references, permissions, and tenant validation.
Map
Approve UPN, immutable-ID, mail nickname, group, device, and synchronization-authority rules.
Migrate core identity
Create or safely update users, groups, devices, and mapped membership; block conflicting anchors.
Expand selectively
Invite approved guests, recreate selected app definitions, and run conditional policy-definition work.
Remediate and validate
Review failures, consent, assignments, licensing, access, guest redemption, device state, and audit evidence.
Governance decisions
Keep privileged and tenant-scoped controls administrator owned.
Migration automation should not silently grant access. Destination administrators retain the decisions that establish trust, privilege, consent, device control, and lifecycle policy.
Match before create
- Immutable-ID and UPN conflict protection
- Entra Connect-owned attribute avoidance
- Explicit source and destination application ID mapping
Consent and access
- Guest invitation and redemption governance
- Application and enterprise-app consent review
- Group, role, license, and app assignment approval
Enrollment and compliance
- Device join or re-enrollment execution
- Certificates, profiles, scripts, and application deployment
- Conditional Access and compliance enforcement validation
Delivery boundaries
Do not confuse object recreation with restored service access.
After a successful Graph write, each dependent control still needs validation under the destination tenant’s identity, security, application, and device operating model.
Directory objects
- Supported users, groups, memberships, and device records
- Selected guest invitations and application definitions
- Per-object creation, update, skip, and failure outcomes
Policy definitions
- Selected Intune configuration and compliance policies
- Microsoft Graph beta endpoint availability
- Field and API compatibility in the destination tenant
Trust and activation
- Secrets, certificates, consent, assignments, and integrations
- Guest redemption, access reviews, and cross-tenant trust
- Device re-enrollment, apps, scripts, certificates, and profiles
Frequently asked questions
Microsoft Entra ID migration questions
How does BridgeAD avoid duplicate synchronized users?
It checks `onPremisesImmutableId` before UPN. If an existing Entra Connect-mastered user has the matching anchor, BridgeAD reuses it and avoids Graph attribute updates. If a UPN is held by an object with a different immutable ID, the operation is blocked for remediation.
Does creating a device object enroll the device in Intune?
No. The supported operation creates or updates the Entra directory record. Device join or registration, Intune enrollment, certificates, compliance state, profiles, scripts, and applications require separate endpoint workflows.
Are guest permissions migrated with the invitation?
No. BridgeAD can invite selected B2B guests and skip existing matches. Guest redemption, group or application assignments, access reviews, entitlement, and cross-tenant trust remain destination governance actions.
Are application secrets and consent grants copied?
No. Selected application definitions and optional service principals can be recreated, but secrets, certificates, owner assignments, delegated or application consent, enterprise-app assignments, and external integration references must be replaced or approved.
What is included in Intune policy migration?
The conditional path recreates selected device-configuration and device-compliance policy definitions through Microsoft Graph beta. It does not migrate assignments, enrollment state, scope tags, certificates, scripts, applications, or device re-enrollment.
Related services
Use stable destination identities across every workload.
Mailbox, content, Teams, and hybrid directory outcomes rely on consistent user and group mappings and on a clearly owned synchronization authority.