Entra Connect Sync to Entra Cloud Sync: Who Is Eligible, What the Guided Migration Does, and What Still Needs the Old Server

Move to Microsoft Entra Cloud Sync when you replace the server unless one of Microsoft's exceptions applies. Microsoft's decision guide, updated 6 October 2026, calls Cloud Sync its strategic direction and says new features are developed primarily there. The exceptions are concrete: more than 150,000 objects in a domain, a group above 50,000 members, pass-through authentication or AD FS configured through the Connect Sync wizard, device writeback, advanced synchronization rules, attribute-based filtering beyond the basics, cross-forest references, or a resource forest holding the mailboxes. If none applies, migrate; Cloud Sync covers Password Hash Sync, password writeback, Exchange hybrid attributes, hybrid join through device sync and seamless single sign-on. If one applies, build a new member server, install Connect Sync 2.6.92.0 with application-based authentication, and meet the 7 April 2027 bar there. Running both is Microsoft's supported pilot model, not a permanent arrangement. If the domain controller you are retiring is one of the last, the better question is whether Active Directory stays at all.

Microsoft's comparison table, updated 6 October 2026, is the eligibility checklist. Both tools synchronize users, groups and contacts, support connected forests, Password Hash Sync, password writeback, Exchange hybrid attributes, directory extensions 1 to 15, custom Active Directory attributes, basic attribute customization, organizational-unit filtering, group writeback V1 for Microsoft 365 groups, cross-domain references and seamless single sign-on. Device synchronization for hybrid join is in both, but in Cloud Sync it is enabled separately, so a tenant with hybrid-joined devices adds device sync to its plan.

Only Cloud Sync offers disconnected-forest synchronization, several active agents with automatic failover, group provisioning from the cloud to Active Directory, on-demand provisioning for testing, and configuration held entirely in the Microsoft Entra admin center.

Only Connect Sync offers the pieces that keep organizations on it:

• domains above 150,000 objects, and groups above 50,000 members (Connect Sync handles 250,000);
• pass-through authentication and AD FS configuration through its wizard, although Microsoft notes both keep working after a migration when managed separately;
• device writeback, which Microsoft describes as discontinued in favor of cloud Kerberos trust, so Windows Hello for Business certificate trust stays with Connect Sync;
• advanced synchronization rules and full attribute-based filtering, where Cloud Sync has an expression builder and limited filtering;
• cross-forest references, merging attributes from several domains, and out-of-band reconciliation;
• a resource forest holding the mailboxes, which Microsoft's scenario table lists for Connect Sync only.

Neither tool provisions users from the cloud to Active Directory. Microsoft's readiness bands follow: ready now under the limits with Password Hash Sync and organizational-unit filtering; near-term if you depend on advanced filtering; evaluate later if you are large, rule-heavy or cross-forest.

Microsoft's guided migration is a documented, phased procedure, not a conversion wizard: at the time of writing nothing turns a Connect Sync server into Cloud Sync in one step, and the guidance is written for servers installed with Express settings. The steps, from the migration page updated 6 October 2026:

1. Assess. Check the comparison table, the Cloud Sync prerequisites, and whether hybrid-joined devices put device sync in scope.
2. Back up Connect Sync. Export the configuration settings file; it is the rollback.
3. Pick a pilot organizational unit and count its users with Get-ADUser. Keep it in Connect Sync scope.
4. Stop the Connect Sync scheduler, then create two rules in the Synchronization Rules Editor: an inbound rule setting cloudNoFlow to True for the pilot objects, and an outbound rule with link type JoinNoFlow scoped to that attribute. Together they stop Connect Sync exporting adds, deletes and non-reference attribute updates for those objects; reference attributes such as member and manager still flow.
5. Install the provisioning agent on a domain-joined server, running under a group managed service account, registered by a Hybrid Identity Administrator.
6. Configure Cloud Sync scoped to the pilot organizational unit, verify the cloud count matches the on-premises count, and create a test user to see it provisioned.
7. Restart the scheduler. Both tools now run: Connect Sync for everything else, Cloud Sync for the pilot.
8. Move the remaining objects in batches, each kept in Connect Sync scope with the no-flow rules until it is fully migrated.
9. Stop Connect Sync for the migrated scope, leave the server disabled for a period, verify, then uninstall it.

The rule Microsoft stresses: never remove organizational units, groups, users or contacts from Connect Sync scope during coexistence, because that drops references in the connector space and can export group membership removals to the tenant. Rollback is short: disable the Cloud Sync provisioning configuration, then disable the custom rules, which triggers a full synchronization on every connector.

Microsoft's hardening update retires, on 7 April 2027, the service-account sign-in Connect Sync uses to reach the tenant: from that date a Connect Sync server below 2.6.84.0, or still authenticating as its Microsoft Entra Connector account, stops synchronizing until it is upgraded and switched. Our companion article on application-based authentication by 7 April 2027 has the version ladder and the switch.

Cloud Sync does not carry that account. The provisioning agent is registered to the tenant by a Hybrid Identity Administrator during installation, runs as a group managed service account, holds only outbound connections through Azure Service Bus, and receives its updates from the cloud. Microsoft's hardening page addresses Connect Sync; at the time of writing it does not list the provisioning agent.

The deadline does not disappear, though. During a phased migration the Connect Sync server is still the active tool for every batch not yet cut over, so if the last batch moves after 7 April 2027 the server must already be on 2.6.84.0 or later with application-based authentication. Either finish the migration and uninstall Connect Sync before that date, or switch the server first and migrate at your own pace. A migration started in the first quarter of 2027 with the old server left unswitched is the one plan that fails.

Microsoft's prerequisites page, updated 27 July 2026, asks for a domain-joined server, recommends Windows Server 2025 or 2022, treats the agent host as a control-plane (Tier 0) asset to be hardened, and states that installing the agent on a domain controller is supported. In a domain controller retirement that permission is beside the point: the domain controller is leaving, and an agent on it would move again with the next one. Put the agents on member servers.

Microsoft recommends three active agents for high availability; they share the load and fail over without configuration changes. Each needs 4 GB of RAM, .NET Framework 4.7.1 or later, outbound HTTPS, the Windows Credential Manager service running, and a schema carrying msDS-ExternalDirectoryObjectId, which Windows Server 2016 and later provide. Older Windows Server versions in extended support are permitted but may need a paid support program, which rules out Windows Server 2016 after 12 January 2027.

The sequence inside a domain controller replacement mirrors a Connect Sync swap, with the agents in place of the staging server: agents installed and the pilot verified, the batches moved, Connect Sync stopped and uninstalled, and only then the domain controller demoted in the order the order of operations for Windows Server 2016 domain controllers sets out. If the exceptions keep you on Connect Sync, the staging-mode swap in moving Entra Connect off a retiring domain controller is the procedure instead. Both paths share one rule: Entra Connect must be gone before the demotion.

A medical practice of about 200 users and about 250 Windows devices is being acquired by a hospital group, with a possession date about four weeks out. It runs Microsoft 365 Business Premium with hybrid identity through a single Entra Connect server on a 2.x build below the 7 April 2027 bar, and the acquirer's security checklist requires central management of all servers. The acquirer will not migrate mail or files and will retire the tenant later.

On the eligibility list the practice is ready now: well under 150,000 objects, Password Hash Sync, organizational-unit filtering, no device writeback. The decision is still to upgrade Connect Sync, not migrate. A sync-tool migration has its own pilot, batches and verification, and its result lives only as long as the tenant; with four weeks and a tenant the acquirer intends to retire, that work has no afterlife. The server is also one of the dozen being brought to a supported operating system for the acquirer's audit row, so the identity change rides inside that upgrade.

The plan in progress: the server's operating system is upgraded to Windows Server 2025, Entra Connect to 2.6.92.0, the wizard task for application-based authentication is run, and Get-ADSyncEntraConnectorCredential is confirmed to read Application before the server joins the others on Azure Arc. The exported settings file is the rollback, and the old service account stays for a week before removal. Cloud Sync is noted in the handover as the acquirer's choice if the tenant outlives its plan, with the eligibility checklist attached.

Neither Connect Sync nor Cloud Sync carries a Microsoft charge. Password writeback needs Microsoft Entra ID P1 on either tool, a Windows Server license covers each agent host or sync server, and any Azure meter, such as Arc add-ons on the hosts, is Microsoft's and is billed to you.

For one server, upgrading Connect Sync onto a replacement member server and verifying application-based authentication sits inside Domain Services and Active Directory Roles Migration, $900 per project over three days, which also moves the retiring domain controller's roles, DNS and DHCP. Across an estate it is a line item in Multi-Site Domain Controller Migration to Windows Server 2025, from $12,500 over eight weeks for one forest, up to six sites and fourteen domain controllers.

A Cloud Sync migration, or the decision to stop synchronizing altogether, is the On-premises Active Directory to Microsoft Entra ID Transition, $4,950 per project over three weeks: the eligibility assessment, the agents, the pilot, the batches and the Connect Sync decommission, or the cloud-only path when Active Directory is not staying. Tenants federated through AD FS move sign-in first with AD FS to Microsoft Entra ID Migration, $4,950 per project over four weeks, because Cloud Sync does not configure federation.

Should we move from Entra Connect Sync to Cloud Sync when we replace the server?

Yes, if none of Microsoft's exceptions applies: under 150,000 objects per domain and 50,000 members per group, Password Hash Sync, organizational-unit filtering, no device writeback, no advanced rules, no cross-forest references. Otherwise build a member server and upgrade Connect Sync there.

What does Cloud Sync not support?

Pass-through authentication and AD FS setup through the wizard, device writeback, advanced synchronization rules, full attribute-based filtering, cross-forest references, merged attributes from several domains, out-of-band reconciliation, a resource forest for mailboxes, domains above 150,000 objects and groups above 50,000 members.

How does the guided migration work, and can we run both?

Both run together: Connect Sync keeps every object in scope with cloudNoFlow and JoinNoFlow rules that stop it exporting the pilot objects, while Cloud Sync provisions them from a scoped organizational unit. Batches follow until Connect Sync is stopped, left disabled for a period, then uninstalled.

Does Cloud Sync meet the 7 April 2027 application-based authentication bar?

The bar applies to Connect Sync's service account; the provisioning agent is registered to the tenant at installation and runs as a group managed service account. A Connect Sync server still active on 7 April 2027 must be on 2.6.84.0 or later with application-based authentication, so finish the migration first or switch the server first.

Can the Cloud Sync agent run on a domain controller?

Microsoft supports it, but a domain controller you are retiring is leaving. Install three agents on member servers running Windows Server 2025 or 2022, hardened as Tier 0, so no later demotion moves them again.