As you may know, Microsoft has announced that migrating to Entra Cloud Sync will be required at some point. There’s no official timeline yet, but tenants that are ready may have already received a notification in the M365 message center. That usually means something!
Another important update: Entra Cloud Sync now officially supports device sync. This was a blocker for many organizations, but it’s finally supported now.
While we still have time, why not use it to prepare? Besides, this is a fairly high-risk change, and it’s probably not the easiest one to sell internally to your boss. It will require resources, and if you do it right, nobody will even notice 😉 But it’ll be worth it, since you’ll be moving to newer technology. Entra Connect Sync has been with us since many of us started our journey to Entra/Azure, and it’s showing its age. So why not move on?
This is the first part of a 3-part blog series: Road to Entra Cloud Sync.
1. Setup and Coexistence
2. Activate Device Sync
3. Migration
So let’s start easy and simply install Entra Cloud Sync, running it alongside Entra Connect. We won’t make many changes yet, just try it out. Cloud Sync consists of two parts: installing the agent and then creating the sync configuration.
Requirements
Entra Cloud Sync works the other way around. Sync happens in the cloud, and on-premises, you only need a lightweight agent. That’s why the requirements are fairly simple. First, you’ll need a virtual machine: ideally a separate one, so avoid installing it on the domain controller or on the existing Entra Connect server. For future resiliency, Entra Cloud Sync also supports multiple VMs with agents. Besides that, there are a few other requirements:
- Domain or Enterprise Administrator credentials in Active Directory (a gMSA account will be created during the setup)
- Hybrid Administrator role in Entra ID
- The VM needs to be domain joined and using Server 2022 or 2025
- It’s considered a tier 0 server
Setup
First, let’s go to the Entra admin center, Entra Connect, Get started, Manage and Download the Provisioning agent. Make you sure you select Cloud Sync agent:
This will download the agent installer, roughly 24 MB in size. Copy it over to your VM and run it there. The agent is called the ‘Microsoft Entra Provisioning Agent.’ On the first screen, leave the checkbox ticked and click Next. This will take you to the step where you’ll need to enter your Entra credentials:
Enter your credentials, click Authenticate, and confirm MFA. Once passed, the wizard will move on to the next step: Create a new gMSA account. Of course, you can also use an existing one, but it needs to have exactly the right permissions, so why the hassle? Let’s just create a new one. Enter your Active Directory credentials (that user needs Enterprise or Domain Admin rights):
If everything entered correctly, the domain will show up and click on next:
Create a sync configuration
Now that the agent is ready, we need to add an actual sync configuration. As mentioned, since the sync now happens in the cloud, this configuration can be done quite comfortably in the Entra admin center: Entra Connect → Cloud Sync → Configurations → New Configuration. As you can see, there’s the option to create a configuration for both directions (AD → Entra or Entra → AD), but for now, we’re focusing on Active Directory to Entra. I’ll cover the other option in the next part of the blog series.
Important note: It can take up to an hour before your active agent shows up here:
Once your AD objects are ready to sync, head back into your Entra Cloud Sync Configuration, Add Scoping filters, enter the Distinguished name of your OU (you can find it by right-clicking on your OU in ActiveDirectory, Properties, Attribute Editor, Look for DistinguishedName there) and click on Add. Then click Save on top.
Go back to Overview → Properties and set the Accidental Deletion Threshold to 5. For this test case, this isn’t really necessary, but in production, you’ll want to set this initially quite low to ensure that misconfigurations can’t accidentally delete a large number of objects:
Now we’re ready to do a test run. Go back to overview and scroll down to Test (recommended) and click on Test provisioning. Enter the distinguished name of your first test user (again can be found in Active Directory, see above). Click on Provision on the bottom:
If successful, you should see an overview screen of your test provisioning. Also check in the Entra admin center under Users to confirm the user appears there and that the attributes are set correctly:
If something’s wrong, you can edit the attributes under Attribute Mapping in your configuration. Now we’re ready to enable the configuration, and all objects will be synced. Go back to your configuration → Overview, scroll down to ‘Enable your configuration,’ and click Review and Enable. Then click Enable Configuration:
The sync will start immediately afterwards and you can check under Users and under Groups if your new objects are there:
Conclusion
Running Entra Cloud Sync alongside Entra Connect Sync was easier than I thought. The option to sync only specific OUs gives you a lot of flexibility. Now you can gradually move OUs over to Entra Cloud Sync, one at a time. By the way, this is also a great opportunity to stop syncing OUs that were never actually needed in Entra in the first place. I’ve seen a lot of customer environments with thousands of groups synced that are never actually used in Entra — this is your chance to finally get rid of them.
The next part of this blog series will focus on activating device sync in Entra Cloud Sync.
Links
