Welche ist die beste von Microsoft unterstützte Methode, um lokales Active Directory über Power Automate-Cloud-Flows zu modifizieren?

Please note that this is the German (de-de) forum. I kindly recommend posting your question in German so that more community members can assist you effectively. If you prefer using English, you are welcome to post in the English forum instead. I sincerely appreciate your understanding and cooperation.

Hi @Faller, Frederik

Based on current Microsoft documentation, there is not a general Microsoft-provided cloud-flow connector that directly performs write operations against on-premises Active Directory through the on-premises data gateway.The on-premises data gateway documentation says the gateway supports connections such as custom connectors, File System, HTTP with Microsoft Entra ID, SharePoint, SQL Server, SAP ERP, Oracle, PostgreSQL, and others, but Active Directory is not listed as a built-in gateway-supported connector for cloud flows.

Reference: Manage an on-premises data gateway in Power Automate

Answers to your specific questions:

1.Does Microsoft provide a supported connector that can update or modify objects in on-premises Active Directory via the On-premises Data Gateway?

At this time, I do not find a Microsoft Learn document that lists a built-in Power Automate cloud connector for direct on-premises Active Directory write operations through the on-premises data gateway. The gateway documentation lists supported connection types, including “Custom connectors that you create” and “Http with Microsoft Entra ID,” but not an Active Directory connector for cloud flows.

Power Automate for desktop does have documented Active Directory actions, including actions to create groups, get group information, get group members, modify groups, create objects, move objects, create users, get user information, modify users, unlock users, and update user information. Those actions require a connection to an Active Directory server using an LDAP path.

So the distinction is important:

Desktop flow: documented AD actions exist.

Cloud flow through on-premises data gateway: I do not find a documented built-in AD connector for general AD write operations; the documented gateway route would be via supported connectors such as custom connectors or HTTP-based access to an API you provide.

Reference: Active Directory actions

2.Would Microsoft recommend Power Automate Desktop as a production-grade integration approach for this scenario, or is it intended primarily for RPA use cases?

Power Automate Desktop (PAD) is positioned by Microsoft as a Robotic Process Automation (RPA) platform. For Active Directory scenarios, PAD is fully capable of performing documented operations such as creating users, modifying user accounts, creating groups, adding or removing group members, and moving directory objects.

That said, from a solution architecture perspective, I would recommend exercising caution before adopting PAD as the central integration layer for multiple Power Apps and cloud flows. PAD operates on a model that relies on machine-based runtimes, unattended execution, and credential management.

As a result, it is generally better suited for RPA workloads than for serving as a reusable, enterprise-wide service layer that exposes Active Directory functionality to multiple applications and automation processes.

3.When a Power App requires an immediate response, is Azure Automation with a Hybrid Runbook Worker still considered the preferred Microsoft solution?

Microsoft documents Hybrid Runbook Worker as the mechanism for running Azure Automation runbooks on a machine that can manage local resources. The documentation says runbooks on a Hybrid Runbook Worker typically manage resources on the local computer or resources in the local environment where the worker is deployed. For synchronous Power App responses, Azure Automation is not the cleanest fit. The documentation positions runbooks as jobs, and it describes job behavior considerations for Hybrid Runbook Workers. My recommendation would be:

• Hybrid Runbook Worker > suitable for asynchronous workflows.
• Custom REST API > suitable for workflows requiring immediate result delivery to Power Apps.

4.Does Microsoft Entra offer any native writeback or provisioning features that are designed to address this type of integration requirement?

There are Microsoft Entra writeback/provisioning capabilities, but they are not a general substitute for arbitrary on-prem AD administration from Power Apps or cloud flows. So Entra writeback can help with some group provisioning/governance scenarios, but the sources do not document it as a synchronous, general-purpose interface for updating arbitrary AD user attributes, disabling users, moving users between OUs, creating users, or managing computers from Power Apps.

5.What is the recommended Microsoft architecture for exposing a reusable integration layer to on-premises Active Directory that can be shared by multiple Power Apps and cloud flows?

Based on my research, I would phrase the architecture guidance like this:

Power Apps / Power Automate cloud flows > Custom connector > On-premises data gateway > Internal REST API hosted inside the network > Least-privilege AD service account / managed identity pattern where applicable > On-premises Active Directory

This aligns with the gateway model because the gateway is documented as a bridge between Power Apps/Power Automate and on-premises data/apps. The Power Platform admin documentation states that Can use and Can use + share apply only to Power Apps and Power Automate, but do not apply to custom connectors; for custom connectors, the gateway must be shared with the Admin permission level. This is an important design consideration if you go with custom connectors and a gateway.

Reference: On-premises data gateway management

I hope this information help.

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click ""Comment"".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.