Hard match-overname in Entra Connect: de blokkade van juni 2026 en wat er openblijft

Connect-MgGraph -Scopes "RoleManagement.Read.Directory", "Directory.Read.All"

$roleNames = @{}
Get-MgRoleManagementDirectoryRoleDefinition -All |
    ForEach-Object { $roleNames[$_.Id] = $_.DisplayName }

$grants = @(
    Get-MgRoleManagementDirectoryRoleAssignment -All |
        Select-Object PrincipalId, RoleDefinitionId, @{ n = 'Kind'; e = { 'Active' } }
    Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All |
        Select-Object PrincipalId, RoleDefinitionId, @{ n = 'Kind'; e = { 'Eligible' } }
)

# Role-assignable groups: rapporteer de leden
$expanded = foreach ($g in $grants) {
    $obj = Get-MgDirectoryObject -DirectoryObjectId $g.PrincipalId
    if ($obj.AdditionalProperties['@odata.type'] -eq '#microsoft.graph.group') {
        Get-MgGroupMember -GroupId $g.PrincipalId -All | ForEach-Object {
            [pscustomobject]@{ PrincipalId = $_.Id; RoleDefinitionId = $g.RoleDefinitionId; Kind = "$($g.Kind) via group" }
        }
    }
    else { $g }
}

$expanded | Group-Object PrincipalId | ForEach-Object {
    $u = Get-MgUser -UserId $_.Name -Property Id, UserPrincipalName, OnPremisesImmutableId, OnPremisesSyncEnabled -ErrorAction SilentlyContinue
    if ($u.OnPremisesImmutableId) {
        [pscustomobject]@{
            UserPrincipalName     = $u.UserPrincipalName
            OnPremisesSyncEnabled = $u.OnPremisesSyncEnabled
            OnPremisesImmutableId = $u.OnPremisesImmutableId
            Roles = ($_.Group | ForEach-Object { "$($roleNames[$_.RoleDefinitionId]) ($($_.Kind))" } | Sort-Object -Unique) -join '; '
        }
    }
} | Format-Table -AutoSize

$immutableId = '<onPremisesImmutableId uit het rapport>'
$bytes = [Convert]::FromBase64String($immutableId)
$ldap  = ($bytes | ForEach-Object { '\{0:x2}' -f $_ }) -join ''
Get-ADObject -LDAPFilter "(mS-DS-ConsistencyGuid=$ldap)" -IncludeDeletedObjects -Properties whenChanged

Connect-MgGraph -Scopes "OnPremDirectorySynchronization.ReadWrite.All"

$OnPremSync = Get-MgDirectoryOnPremiseSynchronization
$OnPremSync.Features | Select-Object BlockCloudObjectTakeoverThroughHardMatchEnabled, BlockSoftMatchEnabled

$OnPremSync.Features.BlockCloudObjectTakeoverThroughHardMatchEnabled = $true
$OnPremSync.Features.BlockSoftMatchEnabled = $true
Update-MgDirectoryOnPremiseSynchronization `
    -OnPremisesDirectorySynchronizationId $OnPremSync.Id `
    -Features $OnPremSync.Features

AuditLogs
| where OperationName in ("Update user", "Set DirSyncEnabled flag")
| where tostring(TargetResources) has_any ("OnPremisesObjectIdentifier", "DirSyncEnabled")
| project TimeGenerated, InitiatedBy, TargetResources