Hybrid Identity with Azure Active Directory

The first two bullet points aren’t entirely correct.

• User objects must be sourced in AD and can be synced into AAD. Certain attributes can be written back for user objects, but a user created in AAD cannot be written back to AD.
• Groups can be written back from AAD -> AD, however
• OUs and group policy objects are not synced – OUs can be used as a provisioning scoping element to decide what is/is not synced, but Azure AD is a flat directory and does not have the concept of OUs. The on premises distinguished name, which aligns with the OU structure/location of an object, is available via certain APIs, but that is merely a string value and user/group/device objects will not be sorted into any sort of tiered/structured directory. AAD also does not have the concept of a group policy object a, and those objects are not part of the scope of what AAD Connect will sync. Intune can be used to replicate most behavior applied via GPOs but not via the GPO mechanisms.