O'Reilly logo
  • Angelie Soto thinks this is interesting:

When an organization is synchronizing their users and groups from an on-premises Active Directory, you need to perform membership changes in that on-premises directory. It is the source of authority, and changes made there synchronize into Azure Active Directory.

From

Cover of Exam Ref 70-533 Implementing Microsoft Azure Infrastructure Solutions

Note

The source of authority is the one that handles group membership access to an specific application.