Entra Policy Suite settings · Settings > Hybrid worker

AD environments (one worker each)

Key	HybridWorker.EnvironmentByUpnSuffix
Where	Settings > Hybrid worker
Type	List
Default	(empty)

What it does

For several Active Directory forests or domains (v1 ran its scripts once per environment: Internal_Prod, DMZ_Prod, Internal_Dev, Internal_Test). Each line sends the AD changes of users whose on-premises user principal name ends in the suffix to the hybrid worker installed for that environment (Install-EpsHybridWorker -Environment <name>). The longest matching suffix wins.

When set

From the next tagging run, each AD change is queued for its user's environment, and only a worker of that environment takes it. A user that matches no line goes to a worker installed without an environment.

When blank or default

Empty (the default): one AD - every worker takes every change.

Risk and how to reverse it

A change for an environment that has no worker waits until one reports (the Hybrid worker page lists such environments). A wrong suffix sends a change to a worker that cannot find the user: it fails with 'not in AD' and can be tried again. Reversible.

Requires

Admin. One hybrid worker per environment, installed with -Environment.