Users and static groups
- Select named source and destination Entra connections
- Enter a target UPN suffix and optional user or group scope
- Preview creates, skips, updates, and membership reconciliation
Microsoft Entra ID
Entra ID migration without identity anchor conflicts.
Entra ID migration creates or updates supported users, groups, devices, and memberships through Microsoft Graph, checks immutable IDs and UPNs before user creation, and respects Entra Connect-owned attributes. Expansion workflows can invite B2B guests, recreate selected application definitions and service principals, and conditionally recreate selected Intune policy definitions.
Supported · core Graph identity operationsUsers, groups, devices, and memberships are supported with configured application permissions. Guests and application definitions require manual governance and remediation. Intune configuration and compliance-policy definitions use conditional Graph beta endpoints.
BridgeAD Cloud WorkloadsCloud identity workspace
Identity dependencies resolved before changeTenant connectivity, consent, mappings, target objects, applications, execution status, and outcome evidence remain visible to operators.
Product view · synthetic demonstration dataOperator experience
Resolve target authority before object creation.
Operators configure Graph connections, validate tenant and application credentials, approve source-to-target mapping rules, identify immutable-ID and UPN collisions, select expansion objects, and review created, updated, skipped, and failed outcomes.
- Tenant, client credential, secret reference, and active-connection validation
- Immutable-ID checks before UPN fallback for users
- Update behavior that avoids overwriting Entra Connect-mastered users
- Idempotent group and device lookup by stable target property
- Selected B2B guest, application, service-principal, and Intune operations
- Source-to-target application ID maps and per-item failure reports
Capability scope
Apply a distinct acceptance test to each object family.
Creating a directory object is not equivalent to restoring its access, credentials, assignments, consent, enrollment, or lifecycle controls. BridgeAD reports object outcomes while the operating model assigns those dependent controls.
| Area | Status | BridgeAD handling | Important boundary |
|---|---|---|---|
| Users | Supported | Checks `onPremisesImmutableId` first, then UPN; reuses or updates safe matches and creates new users with supported attributes. | Hard-match conflicts are blocked. Most attributes on Entra Connect-mastered users remain owned by the synchronization authority. |
| Groups | Supported | Resolves groups by mail nickname, then creates or updates supported display, description, mail, and security settings. | Dynamic rules, role-assignable behavior, licensing, and application-specific group use require separate validation. |
| Group membership | Supported | Adds mapped destination directory objects to resolved destination groups through Microsoft Graph. | Nested behavior, privileged groups, access packages, and application authorization must be reviewed. |
| Tenant-to-tenant users and groups | Supported · route | Uses named source and destination connections, UPN transformation, preview-first execution, optional attribute refresh, and repeat-pass membership reconciliation for static security groups. | Dynamic groups are skipped. Created users receive a single-use forced-change password; licenses, mailboxes, and MFA registration are separate. |
| Entra to on-premises AD | Supported · route | Provisions selected or all users, static security groups, optional contacts, transformed UPNs, and mapped membership through the selected destination agent. | Users start disabled without a password until password sync or reset; membership is limited to platform-provisioned users. |
| Google Workspace directory | Supported · route | Uses a customer service-account secret and delegated admin to preview and sync users or groups into Entra, or provision them directly to AD in one hop. | Passwords never leave Google. Gmail, Drive, and Calendar content are outside the directory workflow. |
| Device directory records | Supported · object | Creates or updates device directory records using the stable device ID and supported operating-system and enabled properties. | A directory record is not device enrollment, join, registration, compliance, certificate, profile, or application migration. |
| B2B guests | Conditional · Supported + governance | Discovers or selects guests, skips existing destination matches, sends or suppresses invitations, and reports failures. | Redemption, access reviews, group and app assignments, entitlement, and cross-tenant trust remain administrator owned. |
| App registrations | Conditional · Supported + remediation | Recreates selected application definitions, including supported web, SPA, public-client, API, required-resource, optional-claim, and tag configuration, and records new application IDs. | Secrets, certificates, consent grants, owners, assignments, and external integration references must be replaced or re-approved. |
| Service principals | Conditional · Optional creation | Can create a destination service principal for a newly recreated selected application. | Enterprise-app assignments, conditional access impact, delegated/application consent, provisioning, and credentials are not copied. |
| Intune policy definitions | Conditional · Graph beta | Recreates selected device-configuration and device-compliance policy definitions using Microsoft Graph beta and reports each outcome. | Beta behavior can change. Assignments, scope tags, enrollment, certificates, scripts, apps, and device state are not implied. |
Application routes
Entra ID and Google Workspace directory migration routes.
The Cloud Expansion workspace presents these as separate forms, not as one generic “Entra migration” switch. For teams researching Azure AD tenant migration, Microsoft Entra ID is the current product name. Named connections replace raw tenant IDs, preview is enabled first, and update-existing mode displays a warning before a live run.
Agent-backed provisioning
- Select the destination AD connection and assigned agent
- Set user and group OUs, UPN transformation, contacts, and membership
- Review disabled-account and password follow-up requirements
Directory to Entra or AD
- Reference the service-account secret and delegated administrator
- Choose users, groups, membership, transformation, and update mode
- Follow created, updated, skipped, failed, and current-item progress
Prerequisites
Approve authority, consent, and collision rules first.
The destination tenant must be able to distinguish cloud-owned from synchronized attributes and must grant only the Graph permissions required for the selected operations.
Domains and source of truth
- Destination domains and UPN suffixes verified
- Immutable-ID, matching, naming, and collision rules approved
- Entra Connect or Cloud Sync authority and sequencing documented
Application and consent
- Source read and destination write permissions selected per scope
- Tenant IDs, client IDs, and secret references validated
- Admin consent, secret rotation, and audit owners assigned
Licensing and governance
- Licenses, privileged roles, Conditional Access, and MFA readiness reviewed
- Guest redemption, application consent, and device owners named
- Rollback and remediation actions defined per object family
Migration workflow
Create the identity foundation before dependent workloads.
Exchange, SharePoint, OneDrive, Teams, and application access all depend on stable destination identities and groups. Application and device expansion should follow explicit selections and separate acceptance criteria.
Connect
Configure source and destination Graph applications, secret references, permissions, and tenant validation.
Map
Approve UPN, immutable-ID, mail nickname, group, device, and synchronization-authority rules.
Migrate core identity
Create or safely update users, groups, devices, and mapped membership; block conflicting anchors.
Expand selectively
Invite approved guests, recreate selected app definitions, and run conditional policy-definition work.
Remediate and validate
Review failures, consent, assignments, licensing, access, guest redemption, device state, and audit evidence.
Governance decisions
Keep privileged and tenant-scoped controls administrator owned.
Migration automation should not silently grant access. Destination administrators retain the decisions that establish trust, privilege, consent, device control, and lifecycle policy.
Match before create
- Immutable-ID and UPN conflict protection
- Entra Connect-owned attribute avoidance
- Explicit source and destination application ID mapping
Consent and access
- Guest invitation and redemption governance
- Application and enterprise-app consent review
- Group, role, license, and app assignment approval
Enrollment and compliance
- Device join or re-enrollment execution
- Certificates, profiles, scripts, and application deployment
- Conditional Access and compliance enforcement validation
Delivery boundaries
Do not confuse object recreation with restored service access.
After a successful Graph write, each dependent control still needs validation under the destination tenant’s identity, security, application, and device operating model.
Directory objects
- Supported users, groups, memberships, and device records
- Selected guest invitations and application definitions
- Per-object creation, update, skip, and failure outcomes
Policy definitions
- Selected Intune configuration and compliance policies
- Microsoft Graph beta endpoint availability
- Field and API compatibility in the destination tenant
Trust and activation
- Secrets, certificates, consent, assignments, and integrations
- Guest redemption, access reviews, and cross-tenant trust
- Device re-enrollment, apps, scripts, certificates, and profiles
Frequently asked questions
Microsoft Entra ID migration questions
How does BridgeAD avoid duplicate synchronized users?
It checks `onPremisesImmutableId` before UPN. If an existing Entra Connect-mastered user has the matching anchor, BridgeAD reuses it and avoids Graph attribute updates. If a UPN is held by an object with a different immutable ID, the operation is blocked for remediation.
Does creating a device object enroll the device in Intune?
No. The supported operation creates or updates the Entra directory record. Device join or registration, Intune enrollment, certificates, compliance state, profiles, scripts, and applications require separate endpoint workflows.
Are guest permissions migrated with the invitation?
No. BridgeAD can invite selected B2B guests and skip existing matches. Guest redemption, group or application assignments, access reviews, entitlement, and cross-tenant trust remain destination governance actions.
Are application secrets and consent grants copied?
No. Selected application definitions and optional service principals can be recreated, but secrets, certificates, owner assignments, delegated or application consent, enterprise-app assignments, and external integration references must be replaced or approved.
What is included in Intune policy migration?
The conditional path recreates selected device-configuration and device-compliance policy definitions through Microsoft Graph beta. It does not migrate assignments, enrollment state, scope tags, certificates, scripts, applications, or device re-enrollment.
Related services
Use stable destination identities across every workload.
Mailbox, content, Teams, and hybrid directory outcomes rely on consistent user and group mappings and on a clearly owned synchronization authority.