User1: Yes

User2: No

Group3: Yes

Microsoft Entra Cloud Sync scoping can be configured by using selected Active Directory security groups or selected organizational units. Microsoft states that Cloud Sync scoping filters define which objects appear in Microsoft Entra ID, and that for security groups and OUs, the administrator supplies the distinguished name. In this case, the distinguished name points to Group1, so Group1 is the scoping group. Objects that are direct members of Group1 are in scope.

User1 syncs because User1 is a direct member of Group1. The user’s OU does not block synchronization here because the configured scope is the Group1 DN, not an OU-only filter. User2 does not sync because User2 is a member of Group2, and Group2 is a member of Group1. That is nested group membership. Microsoft explicitly states that nested groups cannot be used with group scoping and that nested objects beyond the first level are not included when scoping by security groups.

Group3 syncs because Group3 itself is a direct member of Group1. The fact that Group3 has no members is irrelevant; the group object is still directly in scope. Reference topics: Microsoft Entra Cloud Sync scoping filters, selected security groups, distinguished names, and nested group limitations.