Why does OIM provision assignements on AADGroup.OnPremisesSyncEnabled = true?

We have created backlog entry VPR#34448 for this issue. But I am unable to tell how long a fix or improvement is taking.

I also have this issue and I solved it by adding this to the generating condition on the process AAD_Group_Insert/Update/Delete:

$OnPremisesSyncEnabled:Bool$.Equals(False)

Thanks.
So I wasn't totally wrong with my assumption that there should be an improvement on the product side.

Exactly that was an option I was considering as well.
But isn't there a problem, that the entries in DPRMembershipAction are generated and these entries are preventing the sync from doing updates on the memberships on the corresponding groups? (I thing it will generate an error in the sync protocol mentioning that it couldn't be update to to outstanding membership actions)

Or does it work perfect?

I don't have any frozen processes, there are no errors in the AAD Connect-sync, but I have 28 objects in DPRMembershipAction.

What is the purpose of DPRMembershipAction anyway?

To me it looks like it works perfectly..

As far as I understand the DPRMembershipAction collects all the Actions (assign/remove) to be executed for a group.
So if a Membership is removed there will be a corresponding entry in that table.

AAD_Group_Insert/Update/Delete will process exactly these entries when executed. So preventing the execution, will not remove the entries.

I've just done a test with adding $OnPremisesSyncEnabled:Bool$.Equals(False) to gen generating condition.
Setting the person to inactive has finally created some entries im DPRMemberShip Action für AADUserInGroup.
The process AAD_Group_Insert/Update/Delete didn't start.

But in the sync protocol I can see the following:

So, the memberships for hybrid groups aren't updated in the identity manager DB.

Therefore I think, I have to prevent creating entries in DPRMembershipAction, or before doing the provisioning in the process AAD_Group_Insert/Update/Delete delete the unwanted entries.

Or just prevent deleting AADUserInGroup entries for hybrid groups at all, except for the Synchronization User.

Hi,

So assuming you have 'merge mode' enabled ..... in Manager ..... in the Data Synchronization section .... expand Basic configuration data and select Target system types ...... then from the result set choose Azure Active Directory.  Under Tasks click Configure tables for publishing.  In the right hand pane you can edit the Condition to exclude the objects that are causing your issue.

By doing this, the entries won't appear in DPRMemberShipAction.

HTH, Barry.

Where do I find Merge Mode?

EDIT: Found it..

Cool, that helps.

I didn't know that feature at all.

Hi Barry,

Doing what you described will also not insert/remove a record in AADUserInGroup?