Entra Connect Cloud Sync

Entra Connect Cloud Sync (formerly Azure AD Connect Cloud Sync) is a Microsoft identity synchronization service that syncs users, groups, and contacts from on-premises Active Directory (AD) to Entra ID. Unlike Azure AD Connect, which runs as a single Windows service on a dedicated server and requires a persistent SQL database, Cloud Sync uses a lightweight agent model. The service is managed from the Entra admin center, and the sync engine runs in Microsoft's cloud infrastructure. The on-premises component is the Microsoft Entra Connect Provisioning Agent, a small installer that can run on domain-joined or non-domain-joined machines, even on Windows Server Core or in containers.

Cloud Sync addresses several limitations of Azure AD Connect: - Scalability: Azure AD Connect has a practical limit of about 150,000 objects per sync engine instance. Cloud Sync can handle up to 150,000 objects per agent, but you can deploy multiple agents to scale horizontally, supporting millions of objects. - Resilience: If the single Azure AD Connect server fails, sync stops entirely. Cloud Sync supports multiple agents for redundancy; if one agent fails, others continue syncing their scoped objects. - Flexible scoping: Azure AD Connect requires filtering by OUs or domains at the connector level, which is static. Cloud Sync allows dynamic scoping using group-based filtering or OU filters per agent. - Simplified management: No need for SQL Server; configuration is done via the Entra admin center or Graph API. Updates are automatic via the agent's auto-update feature. - Support for disconnected scenarios: Agents can sync over the internet without requiring a VPN or ExpressRoute, as they use outbound HTTPS to the Entra cloud service.

The sync process involves three main components: 1. Provisioning Agent: A Windows service (Microsoft Entra Connect Provisioning Agent) that reads from on-prem AD via LDAP. It can be installed on any Windows Server 2016 or later, or Windows 10/11 (for testing). It communicates only outbound over HTTPS (TCP 443) to the Entra cloud service. 2. Cloud Sync Service: A Microsoft-managed service in Azure that orchestrates sync, stores configuration, and manages agents. It receives changes from agents, processes them through the sync engine (same engine as Azure AD Connect but in the cloud), and writes to Entra ID. 3. Entra ID: The target directory.

The sync flow:

Cloud Sync is configured primarily through the Entra admin center under "Identity > External Identities > Cloud Sync". However, you can use PowerShell for advanced scenarios.

Install the provisioning agent:

# Download the agent from Microsoft Download Center
# Run the installer silently:
AADConnectProvisioningAgentSetup.exe /quiet

Register the agent with your tenant:

# After installation, use the wizard or run:
Register-AADConnectProvisioningAgent -AccountType ServiceAccount -ServiceAccountCredential (Get-Credential)

Create a sync configuration:

# Use the Entra admin center or Graph API. Example Graph call:
POST https://graph.microsoft.com/v1.0/servicePrincipals/{id}/synchronization/jobs

Verify sync status:

# Using AzureAD module (deprecated) or Microsoft Graph PowerShell:
Get-MgServicePrincipal -Filter "displayName eq 'Cloud Sync'" | Get-MgServicePrincipalSynchronizationJob

Check agent health:

# On the agent machine, check services:
Get-Service -Name "Microsoft Entra Connect Provisioning Agent"
# Or view logs in Event Viewer under Applications and Services Logs/Microsoft/Entra Connect Provisioning Agent

A large enterprise acquires a smaller company with its own on-premises AD forest. The acquired company's IT team wants to sync their users to the parent company's Entra ID tenant without disrupting the existing Azure AD Connect deployment. The solution: deploy a Cloud Sync agent in the acquired company's domain, configure it to sync only the OUs containing the acquired users, and set up attribute mappings to match the parent's schema. The agent runs on a low-cost VM in the acquired company's environment, connecting to the parent's tenant over the internet. This avoids the need for network integration or changes to the existing Azure AD Connect server. The parent company can gradually migrate users to the main forest while maintaining sync continuity. In production, the agent handles 20,000 users with no performance issues. The key consideration is that Cloud Sync does not support Exchange hybrid writeback, so if the acquired company uses on-premises Exchange, it must be migrated to Exchange Online or use a separate solution.

A multinational corporation has hundreds of branch offices, each with a local AD domain controller. The WAN links to some branches are slow or unreliable. Deploying a single Azure AD Connect server at headquarters would sync all branches over the WAN, causing delays and potential sync failures. Instead, the company deploys a Cloud Sync agent at each branch. Each agent syncs only its local domain's users to Entra ID. Because the agent uses lightweight outbound HTTPS, it works over any internet connection. If a branch loses connectivity, the agent queues changes and syncs when the link is restored. The cloud service aggregates all changes. This architecture provides resilience: if one branch's agent fails, only that branch's sync is affected. The company manages all agents from a single pane in the Entra admin center. They monitor agent health via heartbeat alerts. A common misconfiguration is forgetting to set the deletion threshold; without it, accidental deletions in AD could propagate to Entra ID. They set the threshold to 500 and require manual approval for deletions.

An organization wants to test Cloud Sync before fully migrating from Azure AD Connect. They deploy a Cloud Sync agent in a test OU containing 1,000 pilot users. They configure Cloud Sync to sync only that OU, while Azure AD Connect continues to sync the rest of the organization. Both sync engines run concurrently, but they must ensure no overlapping scopes. During the pilot, they verify attribute mapping accuracy and sync latency. They discover that Cloud Sync does not support custom attribute mappings for extension attributes that are not in the default set; they need to add them via the mapping editor. After successful testing, they plan to gradually move OUs from Azure AD Connect to Cloud Sync. The migration involves disabling Azure AD Connect for those OUs, enabling Cloud Sync, and running a full sync to ensure consistency. The exam tests this coexistence scenario heavily: candidates must know that Cloud Sync and Azure AD Connect cannot sync the same object, but they can coexist if scopes are disjoint.