Migrate from Microsoft Entra Connect Sync to Cloud Sync FAQ

Microsoft notifies your organization when it becomes eligible to begin migration. Eligibility is determined by factors including your current configuration and supported scenarios, and migration is rolled out in phases. When it's time, you receive clear instructions through official communication channels on how to proceed.

If a confirmed technical or business blocker prevents migration by the date in your tenant-specific notification, request more time through Microsoft Support. Exception requests are reviewed individually, aren't guaranteed, and don't remove the requirement to migrate.

Cloud Sync migration deadlines and windows are organization-specific. Connect Sync version retirement, authentication changes, and other product changes can have different timelines. Follow the migration date in your organization's tenant-specific notification. For exception timing and required evidence, see Request more time to migrate.

Migration time varies with your environment and readiness results. Plan separately for:

• Readiness remediation: Review and resolve the conditions identified by the readiness assessment.
• Configuration transfer: The tool transfers only supported settings and creates the required Cloud Sync configurations and jobs.
• Initial synchronization: After activation, Cloud Sync starts initial synchronization. Review job health and synchronization results.
• Validation: Keep Connect Sync installed during the documented two-week validation period, and manually validate objects, references, and enabled writeback scenarios.

To prepare for migration, explore the following resources:

• What is Cloud Sync
• Cloud Sync deep dive - how it works
• Guided migration-tool prerequisites and limits
• Step-by-step migration guidance

Migration scenarios:

• Migrate to Microsoft Entra Cloud Sync for a synced Active Directory forest
• Migrate Microsoft Entra Connect Sync group writeback v2 to Microsoft Entra Cloud Sync
• Microsoft Entra Cloud Sync vs. Microsoft Entra Connect Sync feature comparison

Connect Sync and Cloud Sync must not simultaneously export normal changes for the same object and attribute set. During the documented manual phased-migration process, objects remain in Connect Sync scope while the cloudNoFlow and JoinNoFlow rules prevent normal Connect Sync exports and preserve required references. Follow the manual migration procedure, and remove Connect Sync scope only after migration and reference validation are complete.

Check the guided migration-tool prerequisites:

• Start the task on the active Connect Sync server, not a server in staging mode.
• Use a supported Connect Sync version on the active installation.
• Your organization and installation must be eligible for the current migration wave.

The tool assesses readiness and transfers supported configurations. Before activation, complete Provision on Demand for each migrated domain configuration. After activation, the wizard compares an aggregate Total Objects count, checks required Cloud Sync job health, and confirms that Connect Sync is in staging mode.

Individual users, groups, memberships, manager relationships, password hash synchronization results, writeback operations, and business-specific outcomes require manual validation. Follow the validation checklist.

Yes. You can pilot the migration using a test Active Directory forest before committing to a full rollout. The tutorial Migrate to Microsoft Entra Cloud Sync for a synced Active Directory forest walks you through a sandbox migration. You can also use on-demand provisioning to validate configuration changes by applying them to a single user.

During guided-tool activation, the tool enables Cloud Sync and places Connect Sync in staging mode. Keep Connect Sync installed during the documented validation period. For manual migration, back up your Connect Sync configuration before making changes by using the import and export settings feature.

Only supported configurations are transferred. Review the tool prerequisites and readiness result, then validate the transferred configuration. Complete on-demand provisioning before activation as described in Verify the configuration with Provision on Demand. After activation, follow the validation guidance. The feature comparison describes platform capabilities, not automatic transfer support.

The decision guide describes Cloud Sync platform capabilities. The migration-tool prerequisites and limits describe what the current guided experience can assess and transfer. A supported Cloud Sync capability doesn't automatically mean that the guided tool can migrate it. Use a documented manual migration procedure only when one is available for your scenario. Otherwise, continue using Connect Sync.

Cloud Sync supports device synchronization, but the guided migration tool currently lists it as a blocking condition. Don't remove required Device Sync configuration to bypass readiness. Review the decision guide, tool requirements, and Device Sync documentation before planning migration. The Device Sync article describes configuration, not a device migration sequence.

For a full feature comparison, see the Connect Sync to Cloud Sync decision guide. The decision guide includes a detailed comparison table covering 40+ capabilities and their availability in Cloud Sync.

Review the decision guide to identify unsupported requirements. Continue using Connect Sync when a required capability or documented migration procedure isn't available. If you've received a migration notification and a confirmed blocker prevents you from meeting its deadline, request more time through Microsoft Support. An exception isn't automatic or guaranteed.

Once you migrate to Cloud Sync, your hybrid authentication features that enable on-premises credentials to be used for accessing cloud resources continue to be available. Features like Pass-Through Authentication and seamless single sign-on are configured separately from the sync tool and remain functional after migration through the Connect Sync configuration wizard.