Manage Active Directory and Microsoft 365 user changes in one place
Whether a user is synced from on-premises Active Directory or cloud-only, admins update their attributes in one place: 365TUNE, with no separate admin task in each console.
The problem with hybrid user updates
An employee moves from Sales to Operations. Their department and manager need updating, but their account is synced from on-premises Active Directory. Microsoft Entra ID rejects the edit, and the next sync overwrites anything that gets through.
365TUNE makes the approved change in Active Directory, where the account is mastered. The updated details then reach Microsoft 365 through your existing directory sync.
Update synced and cloud-only users in one place
365TUNE smartly routes each approved change to the directory that manages the account. It checks the user's source of authority: changes for users synced from on-premises Active Directory go to the Hybrid Agent, which writes them in Active Directory; changes for cloud-only users, including users whose source of authority has moved to Microsoft Entra ID, go straight to Entra ID through Microsoft Graph. Admins make the change once and never have to pick the console.
Active Directory-synced users
365TUNE sends approved profile changes to a Hybrid Agent inside your network. The agent updates permitted fields in Active Directory, and your usual sync updates Microsoft 365.
Cloud-only users
365TUNE makes the changes directly in Microsoft Entra ID. No Hybrid Agent is needed.
The same policy and approval process applies, and each account is updated at its source.
The changes your team makes most often
Job and team changes
Update department, job title, and manager details when employees change roles.
Office and contact details
Keep office, address, and phone information current when employees move.
You choose which Active Directory users and fields are eligible for updates. The agent cannot change anything outside that scope.
Keep the permissions narrow
The Hybrid Agent does one job: it writes the attributes you allow, in the organizational units you choose.
- No inbound access: The agent initiates connections from your network.
- No shared administrator password: It uses a domain-managed service identity with delegated permissions.
- Changes are recorded: Review the request and its outcome in the audit history.
The Hybrid Agent does not create or delete users, reset passwords, or change group memberships.
Works with your existing directory sync
For users managed on-premises, install the 365TUNE Hybrid Agent on a domain-joined Windows member server. It applies only the approved attribute updates you allow.
The agent works alongside your existing Active Directory-to-Entra synchronization; it does not replace it. Cloud-only users do not require the agent.
For requirements and installation steps, read the Hybrid Agent documentation.
See a hybrid user update in 365TUNE
We'll show a department or manager change, from approval in 365TUNE to the updated Active Directory record, and how permissions are limited.
Questions about hybrid identity management
What is hybrid identity management?
Managing users whose accounts are synced from on-premises Active Directory to Microsoft Entra ID. Their attributes must be changed in Active Directory, so 365TUNE sends approved changes there through the Hybrid Agent, and your directory sync carries them to Microsoft 365. Microsoft explains Active Directory's role as the source of authority, and how to move it to the cloud, in Transfer user Source of Authority (SOA) to Microsoft Entra ID.
Can 365TUNE update employees synced from Active Directory?
Yes. For supported profile attributes (department, job title, manager, office, address and phone), the Hybrid Agent applies approved changes to the on-premises account. Your existing sync then updates Microsoft 365.
Does it replace my existing directory synchronization?
No. Your existing Active Directory-to-Entra synchronization remains in place. The agent updates approved attributes at their source.
Can the agent reset passwords or change group memberships?
No. It is limited to permitted profile attributes in the organizational units you authorize. It cannot create or delete accounts, reset passwords, or change group memberships.
Does hybrid identity management require an installation?
Yes, for Active Directory-synced users. The Hybrid Agent runs on a domain-joined Windows member server. Cloud-only users do not need an agent.
Do I need to open inbound firewall ports?
No. The Hybrid Agent makes outbound connections from your network.
Which plan includes this feature?
Hybrid identity management is available with 365TUNE Enterprise.