OASOpen
Architecture
Systems
Back to insights
Cloud & Infrastructure

Entra Connect Sync to Cloud Sync: A Migration Readiness Checklist

Microsoft is moving hybrid identity sync from Entra Connect Sync to Cloud Sync in phases. What has been announced, what blocks the guided tool, and what to check before you switch.

OAS Editorial Team

· 5 min read

Most South African enterprises run hybrid identity: an on-premises Active Directory synchronised to Microsoft Entra ID by a server running Entra Connect Sync, the tool many still call Azure AD Connect. Our Microsoft Azure and 365 page treats that synchronisation as the foundation for Conditional Access and MFA. In April 2026 Microsoft announced that Connect Sync is giving way to Entra Cloud Sync, tenant by tenant. This checklist covers what has been announced, what the tooling can do, and what to confirm before your turn arrives.

What Microsoft has announced

The April 2026 entry on Microsoft's Entra releases page says Microsoft is beginning the transition from Connect Sync to what it calls the "cloud-native" Entra Cloud Sync. From July 2026, customers are notified through the Microsoft 365 Message Center, Entra Connect Health and targeted email about their individual transition timelines. The first waves target tenants whose needs Cloud Sync already meets in full; organisations with advanced features or a large directory will be notified later, as Cloud Sync gains the missing capabilities. The window is set per tenant, so the date in your Message Center post is the one that counts.

Hybrid authentication is not changing: password hash synchronisation, pass-through authentication and seamless single sign-on continue to work after the move.

The version deadline that applies to everyone

Separately from the transition, Connect Sync has its own support clock. Microsoft retires each 2.x version 12 months after the next one is released, and retired versions may stop working without warning. Version 2.5.79.0 reached end of support on 23 October 2026. More importantly, every installation must be on 2.6.84.0 or later, with application-based authentication configured, by 7 April 2027; after that date synchronisation stops on older builds. The installer is available only from the Microsoft Entra admin centre. If your sync server has not been touched since it was built, this is the first item to fix.

How Cloud Sync differs from Connect Sync

Cloud Sync replaces the sync server with a lightweight provisioning agent and moves the configuration into the Entra admin centre. Microsoft's feature comparison, updated on 21 October 2026, is the authoritative list; the differences that most often decide a migration are:

  • Scale. Cloud Sync supports up to 150,000 objects per domain and groups of up to 50,000 members. Connect Sync has no per-domain limit and handles groups of 250,000.
  • Sync rules and filtering. Connect Sync's advanced sync rule engine has no equivalent in Cloud Sync, which offers an expression builder and basic attribute filtering. OU-based filtering works in both.
  • Forest topology. Cloud Sync supports disconnected forests, but not cross-forest references or merged attributes from multiple domains.
  • Resilience. Several active Cloud Sync agents can run at once for failover; Connect Sync allows one active server plus a staging server.
  • Writeback. Both support password writeback, Exchange hybrid attributes and group writeback v1. Device writeback stays with Connect Sync; group provisioning to Active Directory exists only in Cloud Sync.
  • Authentication setup. Pass-through authentication and ADFS configuration remain tasks for the Connect Sync wizard.

If a capability you need sits in the Connect Sync-only column, Microsoft's guidance is to stay on Connect Sync until a documented path exists, and to request more time through a support case if a confirmed blocker prevents you meeting your deadline.

What the guided migration tool can handle

Connect Sync 2.6.91.0, released on 16 September 2026, added a guided workflow under Configure, labelled Transition to Cloud Sync. The option appears only on installations in the current migration wave, and only on the active server.

Its limits are narrow: a single forest, no more than 2,000 in-scope objects and no more than 30 included OU containers per domain. It stops on custom synchronisation rules, group filtering, a custom UPN, directory extensions, device synchronisation and unsupported writeback scenarios, and it needs a Hybrid Identity Administrator in Entra plus Domain Admin credentials for the forest.

When the readiness review passes, the tool installs the provisioning agent, creates a Cloud Sync configuration per domain, lets you test representative users and groups with provision on demand, then enables Cloud Sync and places Connect Sync in staging mode for a two-week validation period before the migration is completed.

Larger or more complex environments follow the manual, phased procedure: objects stay in Connect Sync scope under no-flow rules while batches, typically by OU, move to Cloud Sync, because removing scope early can delete group memberships in Entra ID.

Readiness checklist

Work through these before your wave opens.

  1. Confirm the version. Record the build on every sync server, including staging, and plan the upgrade to 2.6.84.0 or later ahead of 7 April 2027.
  2. Count the objects. Users, groups, contacts and devices in scope per domain, plus the largest group's membership, against the limits above.
  3. Export the configuration. Custom sync rules, attribute filters, directory extensions, custom UPN suffixes and writeback settings are each a blocker or a manual task.
  4. Map authentication. Note whether you use password hash sync, pass-through authentication, seamless SSO or ADFS, and which server hosts the agents.
  5. Check device join. If hybrid Entra join is in use, device sync must be enabled separately in Cloud Sync and blocks the guided tool.
  6. Watch the notifications. Message Center posts and Connect Health alerts should reach a named owner, not an unread shared mailbox.
  7. Plan the validation. The tool compares total object counts and job health only; decide in advance which users, groups, memberships and writeback cases you will test by hand.

Why this is an identity project, not a server upgrade

Every Conditional Access decision and MFA prompt depends on the account that sync creates. Our guide to Conditional Access policies that work assumes the groups behind those policies are complete; a migration that drops a membership silently weakens them, and the same holds for a zero trust approach. Give the move a change window, a test plan and a rollback. The two-week staging period is the rollback; use it.

Sources

Plan the Connect Sync upgrade and the Cloud Sync move with OAS Microsoft Azure and 365 services.

Keep exploring

All insights