A hybrid worker for Active Directory
Tags of AD-synced users are written in Active Directory by a small worker that only connects out and has no password.
Purpose
For a synced user Active Directory is the source of truth: a tag written only in Entra ID is overwritten by the next sync. The tag has to be written in AD, by something that may write there and nothing more.
Design
The worker is a scheduled task on a domain-joined Windows Server (an Azure VM or an Azure Arc-enabled server). It connects out to the Entra Policy Suite database with the server's managed identity, takes the AD changes the tagging job recorded, writes them as a group managed service account delegated to the tag attributes in the OUs you name, and reports a heartbeat. It refuses an attribute the AD schema does not have, and says so in the result. It can run on its own server or share the server of a PIM Manager hybrid worker, with its own identities.
Business opportunities
Hybrid tenants get the same tagging as cloud-only tenants, without an inbound connection, a stored password or a PowerShell module.
Related features
Rules you edit like a spreadsheet
Every tagging rule on one page, edited like Excel: select, copy and paste, fill down, duplicate, move and switch on or off - many rules at once.
User tagging
Every user gets its tags from your rules - cloud users in Entra ID, AD-synced users in Active Directory.
Device tagging
Every device gets its category - privileged access workstation, corporate Windows, kiosk, corporate or personal phone - from your device rules.
Jobs on your schedule
Every job runs on the schedule you set - daily, weekly or every few hours - with Preview and Apply on demand.