Best Practices for Migrating Users from Active Directory Profile to Entra ID Profile

Products Password Secure Discussions & Questions
,
1

Hello Netwrix Team & Community,

we are currently evaluating a migration from an Active Directory profile to a Microsoft Entra ID profile in Netwrix Password Secure and would like to ask whether there are any recommended best practices or migration procedures for this scenario.

  • We currently authenticate and synchronize users via an Active Directory profile
  • Our on-premises Active Directory users are synchronized to Microsoft Entra ID via Microsoft Entra Connect
  • Therefore, the AD user and the Entra ID user represent the same identity from a business perspective.
  • Password Secure Application Server: Windows Server 2025
  • Password Secure Client & Web Version: 26.6.100.34161

Following the Netwrix documentation for Microsoft Entra ID integration, we have:

  • Created the Entra ID profile in Password Secure
  • Configured SCIM provisioning via App Registration
  • Successfully provisioned a test group and a test user from Entra ID

After provisioning the test user, we now see two user objects in Password Secure:

  1. User associated with the Active Directory profile
  2. User associated with the Entra ID profile

Although both objects represent the same person, they appear as separate users in Password Secure.

In addition, the user’s personal (test) passwords are only visible under the existing AD-based user object and are not available under the newly provisioned Entra ID user object.

Questions

  1. Licensing

    • Does this situation consume two licenses, since two user objects exist in Password Secure Or does Password Secure recognize that both accounts belong to the same underlying identity?

  2. User Migration

    • Is there a supported way to merge or link the AD-based user with the Entra ID-based user?
    • Can existing permissions, ownerships and personal passwords be transferred from the AD user object to the Entra ID user object?

  3. Best Practice

    • What is the recommended migration path when moving from an Active Directory profile to an Entra ID profile?
    • Are there any documented best practices to avoid duplicate users and preserve existing user data?

Thank you!

Kind regards,

Sarah Dreiucker

1 Like