Active Directory to Microsoft Entra ID Migration: Hybrid and Cloud-Only Paths

The short version: There are two end states. Hybrid keeps Active Directory and synchronises users to Microsoft Entra ID with Microsoft Entra Connect Sync or Microsoft Entra Cloud Sync. Cloud-only moves users, devices and apps to Entra ID and Intune and then switches synchronisation off. Most small and mid-sized firms do hybrid first and go cloud-only when the last app that needs Active Directory has gone. For a new sync setup Microsoft recommends Cloud Sync unless you need something only Connect Sync offers.

This guide is for IT managers and engineers who run an Active Directory domain and Microsoft 365. After reading it you can pick a path, work through a pre-migration checklist, follow the steps with the exact admin centre menus, and verify the result. Facts about names, versions and limits were checked against Microsoft Learn on 28 October 2026.

Names and status you should know first

• Azure AD Connect is now Microsoft Entra Connect Sync. Microsoft's page states that Azure AD Connect V1 was retired on 31 August 2022 and is no longer supported.
• Microsoft Entra Cloud Sync is the cloud-managed alternative. It uses a lightweight agent on a domain-joined server and a configuration stored in Entra ID. Microsoft calls it the strategic direction for hybrid identity synchronisation, and says new features are being built mainly on Cloud Sync.
• Mandatory Connect Sync upgrade: Microsoft's prerequisites page says you must upgrade Connect Sync to version 2.6.84.0 or later and configure application-based authentication by 7 April 2027, or synchronisation will stop. Read your tenant's own notices as well, because Microsoft says Connect Sync version retirement, authentication changes and Cloud Sync migration can have different timelines.

Choose your path

Pick hybrid if any of these is true:

1. Servers, file shares, printers or line-of-business apps still authenticate with Kerberos or NTLM against Active Directory.
2. Windows devices are still domain-joined and you rely on Group Policy.
3. You are not ready to run all device management from Intune.

Pick cloud-only if all of these are true:

1. Your users work mainly in Microsoft 365 and other apps that sign in through Entra ID.
2. New devices can be Microsoft Entra joined and managed with Intune.
3. The remaining on-premises apps can move, be replaced, or run against Microsoft Entra Domain Services.

Microsoft describes Microsoft Entra hybrid join as an interim step on the road to Microsoft Entra join, and recommends deploying new devices as cloud-native Entra joined rather than hybrid joined. So even a hybrid project should plan for the end state.

Pre-migration checklist

1. List what depends on Active Directory: apps using LDAP, Kerberos or NTLM, Group Policy, file shares, printers, RADIUS, VPN and any service accounts.
2. List every device by join state: domain-joined, hybrid joined, Entra joined, or not joined.
3. Confirm a routable domain. Users sign in with a verified domain. If an on-premises UPN suffix is not a verified domain (for example .local), Entra ID gives the synchronised user a MailNickName@tenant.onmicrosoft.com sign-in name instead. Add a routable suffix in Active Directory Domains and Trusts, verify the domain in Entra ID, then update users' UPNs before the first sync.
4. Clean up the directory. Run Microsoft's IdFix tool to find duplicates and formatting errors before you synchronise.
5. Enable the Active Directory recycle bin (Microsoft recommends it).
6. Check domain controllers. The domain controller used must be writable (a read-only domain controller is not supported), and dotted NetBIOS names are not supported.
7. Create a cloud-only emergency administrator so you cannot be locked out if on-premises services fail. Microsoft calls this critical for Cloud Sync.
8. Pick the sync server. It must be domain-joined (Microsoft recommends Windows Server 2025 or 2022), and not Server Core. Treat it as a Tier 0 / control plane asset: restrict admin access, deny NTLM, and require MFA for privileged accounts (see how to enable MFA in Microsoft 365).
9. Check object counts and plan a pilot. A new tenant allows 50,000 objects by default, rising to 300,000 once you verify a domain; Connect Sync's default SQL Express LocalDB (10 GB) manages roughly 100,000. Pick a pilot OU with a few test users and one tester per department.
10. Check licensing. Connect Health needs Entra ID P1, and automatic Intune enrolment through Autopilot needs Entra ID P1 or P2 for configuration. Intune plan choices are in Microsoft Intune pricing plans.
11. Back up and document: export current Connect Sync settings (View or Export Current Configuration in the wizard) and keep the files safely.

Path A: hybrid with synchronisation

Choose Cloud Sync or Connect Sync

Use the same points for both.

Cloud Sync

• Choose it when: you are building a new sync, want no single point of failure, have several disconnected forests, or want less server maintenance.
• Limits: up to 150,000 objects per domain, groups of up to 50,000 members, limited attribute-based filtering, no advanced sync rules, no cross-forest references, no device writeback, and no pass-through authentication or AD FS setup (those are managed separately).
• Server needs: a domain-joined Windows Server 2016 or later (2022 or 2025 recommended), at least 4 GB RAM, .NET 4.7.1 or later, TLS 1.2, and outbound ports 80 and 443.

Connect Sync

• Choose it when: you need custom sync rules, full attribute-based filtering, very large groups or scale, cross-forest references, or the other features Microsoft lists as Connect-only.
• Server needs: a domain-joined Windows Server with a full GUI, .NET Framework 4.7.2 or later (the banner on Microsoft's prerequisites page says 4.7.2; the body text lists 4.6.2 as the minimum, so use 4.7.2), TLS 1.2, a Hybrid Identity Administrator or Global Administrator account assigned directly (not through a group), and an Enterprise Administrator account if you use Express settings.

Set up Cloud Sync (new installation)

1. Sign in to the Microsoft Entra admin center as at least a Hybrid Identity Administrator.
2. Go to Entra ID > Entra Connect > Cloud sync > Agents, select Download on-premises agent, and accept the terms.
3. Run the installer on the sync server. Sign in with a Hybrid Identity Administrator account, choose Create gMSA and enter domain administrator credentials, add your domain, and select Confirm.
4. In Cloud sync, select New configuration > AD to Microsoft Entra ID sync, choose the domain, decide whether to enable password hash sync, and select Create.
5. Under scoping filters, select Selected organizational units and add only your pilot OU.
6. Use Provision on demand to test one user, and read the detailed result.
7. Select Enable configuration. Check the users in the Entra admin center.
8. Widen the scope to more OUs in batches, and use Restart sync after each scope change.

Set up Connect Sync (new installation)

1. Download the installer from the Microsoft Entra admin center (Microsoft says it is available only there).
2. Install on a domain-joined server and choose Express or Custom settings. Use Custom if you need a specific service account, SQL Server or filtering.
3. Filter to your pilot OU first.
4. Use these commands to check and run the scheduler. Disable the scheduler before changing sync rules and enable it again afterwards. If the cmdlets are missing, run Import-Module ADSync.

Get-ADSyncScheduler
Set-ADSyncScheduler -SyncCycleEnabled $false
Set-ADSyncScheduler -SyncCycleEnabled $true
Start-ADSyncSyncCycle -PolicyType Delta

1. Widen the filter in batches, running a delta cycle after each. Keep a second server in staging mode as your standby.

If you already run Connect Sync

Microsoft's recommended order is: read the decision guide, try the guided migration tool, and use the documented manual pilot only if the tool does not support you.

1. Open the Connect Sync wizard on the active server, select Configure, then Transition to Cloud Sync.
2. The tool only appears for eligible tenants and installations, and has limits: one forest, up to 2,000 in-scope objects, up to 30 included containers per domain, and no blocking features such as custom sync rules, group filtering, custom UPN, directory extensions or device sync.
3. After the readiness review it creates disabled Cloud Sync configurations. Test with Provision on demand, then activate. Activation puts Connect Sync into staging mode.
4. Validate users, groups, memberships and writeback by hand, and keep Connect Sync installed for the two-week validation period before uninstalling.
5. If the tool does not fit, Microsoft documents a manual phased pilot. Do not remove OUs or groups from Connect Sync scope until references are verified, or group memberships can be removed.

Path B: cloud-only

1. Stop new dependencies on Active Directory. Every new app uses Entra ID sign-in.
2. Move devices. Deploy new Windows devices with Windows Autopilot as Entra joined and enrol them in Intune. Convert existing domain-joined or hybrid joined devices by reinstalling through Autopilot for existing devices (this scenario needs Microsoft Configuration Manager). For managed device policy, see our Intune management service.
3. Move file and print access. Entra joined devices keep single sign-on to on-premises resources only with line of sight to a domain controller (a VPN when away from the network). Plan to move files to SharePoint or OneDrive where you can.
4. Handle the remaining legacy apps. Replace them, or use Microsoft Entra Domain Services as a bridge for apps that need LDAP, Kerberos or NTLM.
5. Know what will break. Microsoft states that apps relying on Active Directory machine authentication do not work on Entra joined devices, because those devices have no computer object in AD DS. If nothing still depends on Kerberos, NTLM or machine authentication, you no longer need Active Directory. If something does, keep a small one until it is retired.
6. Remove the sync client, then turn off synchronisation. Microsoft advises uninstalling Connect Sync or Cloud Sync first. Then run:

Connect-MgGraph -Scopes "Organization.ReadWrite.All,Directory.ReadWrite.All"
Get-MgOrganization | Select OnPremisesSyncEnabled
$organizationId = (Get-MgOrganization).Id
$params = @{ onPremisesSyncEnabled = $false }
Update-MgOrganization -OrganizationId $organizationId -BodyParameter $params
Get-MgOrganization | Select OnPremisesSyncEnabled

Microsoft warns that after this you must wait 72 hours before you can turn directory synchronisation back on, that it clears several on-premises properties (including the on-premises distinguished name and SAM account name), and that you should contact support if you need help. Do this last, after a pilot, and never as a troubleshooting step.

Common mistakes

• Skipping IdFix and the UPN check. Fix: duplicates and non-routable suffixes cause sync errors and sign-in problems later.
• No cloud-only emergency administrator. Fix: create it before anything else.
• Leaving the sync server unhardened. It can change users in Entra ID. Fix: treat it as Tier 0, restrict access, deny NTLM and require MFA for admins.
• Disabling soft matching too early. Existing cloud users may not match. Fix: keep it until matching is finished, then disable soft matching and hard match takeover if you do not need them.
• Cutting over too fast. Removing objects from Connect Sync scope early can remove group memberships, and uninstalling Connect Sync straight after cutover removes your fallback. Fix: verify references first and keep Connect Sync installed, disabled, through the validation period.

How to check it worked

1. For Cloud Sync, open Entra ID > Entra Connect > Cloud sync > Agents and confirm each agent is active. On the server, confirm the services Microsoft Azure AD Connect Agent Updater and Microsoft Azure AD Connect Provisioning Agent are running.
2. Compare the user count in your pilot OU in Active Directory with the synchronised count in Entra ID. Microsoft's pilot guide uses Get-ADUser -Filter * -SearchBase "OU=Pilot,DC=contoso,DC=com" (replace with your pilot OU) for the on-premises side.
3. Create a test user in the pilot OU and check it appears in Entra ID. Change an attribute and check it updates.
4. For Connect Sync, run Get-ADSyncScheduler and confirm sync is enabled and the next cycle is scheduled.
5. Sign in as test users from a domain-joined device and from an Entra joined device. Test MFA, file shares and one legacy app. Once cloud sign-in is the main path, add conditional access baseline policies.
6. After the cloud-only step, run Get-MgOrganization | Select OnPremisesSyncEnabled and confirm the value is no longer true. Check that password reset, mailbox access and sign-in still work for pilot users.

FAQ

How do I migrate on-premises Active Directory to Microsoft Entra ID step by step?

Work through the pre-migration checklist, set up Cloud Sync or Connect Sync with a pilot OU, widen in batches, then decide whether to stay hybrid or follow Path B to cloud-only.

Is Azure AD Connect the same as Microsoft Entra Connect?

Yes. Azure AD Connect was renamed Microsoft Entra Connect, and the sync component is Microsoft Entra Connect Sync. Version 1 was retired on 31 August 2022.

What is the difference between Microsoft Entra Connect and Cloud Sync?

Connect Sync is a full sync engine on one on-premises server. Cloud Sync is managed in the cloud with lightweight agents, but has limits on scale, filtering and rules.

Is moving to Entra ID the same as moving Active Directory to Azure?

No. Entra ID is the cloud identity service, not a copy of your domain. Microsoft Entra Domain Services is the Azure-hosted option for legacy apps that need LDAP, Kerberos, NTLM or domain join. Microsoft describes it as a transitional capability, not a general replacement for on-premises Active Directory and not a sync tool.

To plan and run the migration with engineers who do it regularly, see our managed IT cloud services.