Microsoft Entra ID in 2026 – Part 2: Microsoft Entra Cloud Sync Deep Dive – Architecture, Installation, Best Practices and Migration

 

Introduction

In Part 1, we discussed Microsoft's retirement of Microsoft Entra Connect Sync and why organizations need to start planning their migration strategy now.
Link is here - https://mohitkumarmct2006.blogspot.com/2026/06/the-big-story-microsoft-is-ending-on.html 

In this article, we'll explore Microsoft's recommended replacement—Microsoft Entra Cloud Sync.

We'll cover:

• What Cloud Sync is
• How it works
• Architecture
• Supported scenarios
• Installation
• High Availability
• Security
• Limitations
• Best Practices
• Migration Strategy
• Frequently Asked Questions

---

What is Microsoft Entra Cloud Sync?

Microsoft Entra Cloud Sync is Microsoft's lightweight identity synchronization solution for hybrid environments.

Unlike Microsoft Entra Connect Sync, which performs synchronization using a dedicated synchronization engine installed on a Windows Server, Cloud Sync moves most synchronization logic into Microsoft's cloud.

Only lightweight provisioning agents remain on-premises.

This significantly reduces administrative overhead while improving resilience and scalability.

---

Why Microsoft Introduced Cloud Sync

Traditional Entra Connect required:

• SQL LocalDB
• Synchronization Engine
• Scheduler
• Server Maintenance
• Version Upgrades
• Health Monitoring

Cloud Sync removes nearly all of these components.

Instead:

• Lightweight Agent
• Cloud-managed synchronization
• Automatic updates
• No SQL database
• Easier deployment

---

Cloud Sync Architecture

Active Directory
        │
        │ LDAP
        ▼
+-------------------+
| Provisioning Agent|
+-------------------+
        │
 HTTPS 443
        │
        ▼
Microsoft Entra ID
        │
Synchronization Engine
(Runs in Microsoft Cloud)

---

Components

On-Premises

• Active Directory
• Provisioning Agent
• Optional additional agents

Cloud

• Microsoft Entra Provisioning Service
• Synchronization Rules
• Monitoring
• Health Dashboard

---

Communication Flow

1. Agent reads AD objects.
2. Agent securely communicates with Microsoft Entra.
3. Microsoft performs synchronization.
4. Objects appear in Entra ID.
5. Azure applications authenticate users.

---

Supported Authentication Methods

Cloud Sync supports:

✅ Password Hash Synchronization

✅ Password Writeback

✅ Group Writeback (supported scenarios)

✅ Hybrid Identity

Works with:

• Microsoft 365
• Teams
• Exchange Online
• SharePoint Online
• Intune

---

High Availability

One major improvement over Entra Connect is support for multiple active agents.

Example:

        DC1
          │
     Agent 1
          │
          ├────► Microsoft Entra
          │
     Agent 2
          │
        DC2

Benefits:

• No single point of failure
• Automatic failover
• Load balancing
• Business continuity

---

Security Advantages

Cloud Sync improves security by:

• No inbound firewall ports
• Outbound HTTPS only
• Certificate-based authentication
• Encrypted communication
• Least privilege
• Cloud-managed service

---

Installation Requirements

Supported Operating Systems:

• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Requirements:

• .NET Framework
• Internet access (HTTPS 443)
• Enterprise Admin (installation)
• Global Administrator or Hybrid Identity Administrator

---

Installation Walkthrough

Step 1

Open Microsoft Entra Admin Center.

Step 2

Navigate to:

Identity → Hybrid Management → Cloud Sync

Step 3

Download the Provisioning Agent.

Step 4

Install the Agent.

Step 5

Sign in using a Global Administrator account.

Step 6

Register the agent.

Step 7

Create a synchronization configuration.

Step 8

Select:

• Forest
• OU filtering
• Group filtering
• Password Hash Sync

Step 9

Validate synchronization.

---

Supported Features

Feature	Cloud Sync
Password Hash Sync	✅
Multiple Forests	✅
OU Filtering	✅
Group Filtering	✅
Automatic Updates	✅
High Availability	✅
Multiple Agents	✅

---

Current Limitations

Cloud Sync is not a complete replacement for every Entra Connect scenario. Organizations should review Microsoft's latest feature comparison before migrating. Depending on your environment, advanced scenarios may require additional planning.

Examples to evaluate include:

• Complex synchronization customizations
• Certain Exchange hybrid configurations
• Advanced writeback scenarios
• Specialized synchronization rules

Always validate your environment against current Microsoft guidance before moving production workloads.

---

Migration Strategy

Recommended approach:

Phase 1

Inventory current Entra Connect configuration.

Phase 2

Identify unsupported features.

Phase 3

Deploy Cloud Sync agent.

Phase 4

Pilot with a small Organizational Unit.

Phase 5

Validate users, groups and passwords.

Phase 6

Expand synchronization scope.

Phase 7

Retire Entra Connect.

---

Best Practices

✔ Deploy at least two provisioning agents for high availability.

✔ Keep agents close to domain controllers to minimize latency.

✔ Use dedicated service accounts where appropriate.

✔ Limit synchronization to required Organizational Units.

✔ Monitor provisioning logs regularly.

✔ Document synchronization scope and configuration.

✔ Test password synchronization after deployment.

✔ Review synchronization errors weekly.

---

Common Troubleshooting

Users not syncing

Possible causes:

• OU filtering
• Disabled user
• Missing permissions
• Agent offline

---

Passwords not syncing

Check:

• Password Hash Sync enabled
• Agent status
• Network connectivity
• Event Viewer

---

Agent Offline

Verify:

• Internet connectivity
• Firewall
• TLS
• Proxy configuration
• Agent service

---

Frequently Asked Questions

Can Cloud Sync replace Entra Connect?

For many organizations, yes. However, environments using advanced or legacy synchronization features should compare supported capabilities and plan migrations carefully.

Does Cloud Sync require SQL Server?

No.

Can I install multiple agents?

Yes.

Does Cloud Sync support multiple forests?

Yes.

Is Cloud Sync more secure?

It reduces the on-premises footprint and uses outbound-only communication with Microsoft Entra, which can simplify operations and improve security when deployed according to best practices.

---

Conclusion

Microsoft Entra Cloud Sync represents Microsoft's long-term direction for hybrid identity synchronization. Its lightweight architecture, simplified management, built-in high availability, and cloud-managed synchronization make it an attractive option for many organizations planning beyond Microsoft Entra Connect Sync.

If you haven't started evaluating Cloud Sync yet, now is the time to assess your environment, identify any unsupported scenarios, and begin planning a phased migration before support deadlines approach.

• I will publish Part 3: "Migrating from Microsoft Entra Connect Sync to Cloud Sync – A Step-by-Step Guide with Zero Downtime." This encourages readers to continue through the series and strengthens internal linking for SEO.