# Microsoft Entra Connect

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/microsoft-entra-connect

## Quick definition

Microsoft Entra Connect is a free Microsoft tool that connects your company's local user directory (like Windows Server Active Directory) to the cloud-based Microsoft Entra ID. It syncs user accounts, passwords, and groups so that people can use the same credentials to log into both local systems and cloud services like Microsoft 365. This eliminates the need to manage separate usernames and passwords for cloud and on-premises resources.

## Simple meaning

Think of Microsoft Entra Connect as a reliable bridge between your company's old-school local phonebook (on-premises Active Directory) and a modern, cloud-based phonebook (Microsoft Entra ID). In many organizations, employees are already managed in a local directory on a server inside the company building. That directory stores usernames, passwords, group memberships, and other details. The problem is that cloud services like Microsoft 365, Azure, or other SaaS apps need their own user directory to know who can log in and what they can access. Without a bridge, IT staff would have to create and update every user twice, once in the local directory and once in the cloud. That is tedious and error-prone. Microsoft Entra Connect automates this by copying user information from the local Active Directory to the cloud on a regular schedule. When a new employee joins, you add them once in the local directory, and Entra Connect automatically creates their cloud account. When someone changes departments, you update their group membership locally, and the sync updates the cloud. It also offers options for password synchronization, so users can use the same password for both local and cloud logins, and even enables seamless single sign-on where users are automatically signed into cloud apps without re-entering their credentials. However, the bridge works in only one direction for most data, changes in the local directory flow to the cloud, but changes made directly in the cloud can be overwritten by the next sync. This keeps the on-premises directory as the authoritative source for identity information, which is a common practice in enterprise environments.

## Technical definition

Microsoft Entra Connect is the successor to earlier identity synchronization tools like DirSync and Azure AD Sync. It is a Microsoft-provided on-premises application that integrates on-premises Active Directory Domain Services (AD DS) with Microsoft Entra ID (formerly Azure Active Directory). Its primary function is to synchronize identity objects, such as users, groups, contacts, and devices, from on-premises AD DS to Microsoft Entra ID, enabling hybrid identity scenarios. It supports three primary authentication methods: Password Hash Synchronization (PHS), Pass-Through Authentication (PTA), and Federation (e.g., with Active Directory Federation Services or AD FS). Password Hash Synchronization works by hashing on-premises user passwords and synchronizing those hashes to Microsoft Entra ID. This allows users to sign into Microsoft cloud services using the same password they use on-premises. Pass-Through Authentication delegates on-premises password validation to an on-premises agent, meaning passwords never leave the local network but cloud sign-ins are still verified against the local directory. Federation uses a trust relationship established between the on-premises federation server (like AD FS) and Microsoft Entra ID, redirecting authentication to the on-premises server. Microsoft Entra Connect also provides optional features such as Seamless Single Sign-On (SSO), which silently authenticates users on domain-joined devices without prompting for credentials; and device writeback, which allows devices registered in Microsoft Entra ID to be written back to on-premises AD DS. The synchronization engine uses the Microsoft Identity Manager (MIM) synchronization engine under the hood. It works by connecting to both directories, evaluating changes based on anchor attributes (like objectGUID in AD DS or ImmutableId in Entra ID), and then applying the appropriate import, synchronization, and export rules. The tool uses a staging and import process where it first imports objects from both directories into a metaverse, reconciles conflicts based on precedence rules, and then exports changes to the target directory. A typical synchronization cycle runs every 30 minutes by default, but administrators can trigger a full or delta sync manually. Microsoft Entra Connect also supports filtering via domain/OU filtering, attribute-based filtering, and group-based filtering to control which objects are synced. It is a critical component for any organization that maintains an on-premises directory and uses Microsoft cloud services.

## Real-life example

Imagine you are the office manager at a growing company that has two separate filing cabinets. The first filing cabinet is the old wooden one in the back office, it holds all the employee files with names, job titles, phone numbers, and access badges. This cabinet is managed by the HR department, and everyone trusts it as the source of truth for who works there. The second cabinet is a brand new, sleek metal cabinet in the reception area. The receptionist uses it to know who is allowed in the building and who gets a visitor badge. The problem is that the two cabinets are not connected. When HR hires a new accountant, they update the old wooden cabinet, but the receptionist's cabinet still shows last year's employee list. To fix this, the company hires a dedicated clerk named “Connect.” Every morning, the clerk copies any changes from the old cabinet, new hires, departures, title changes, and writes them onto new index cards for the reception cabinet. This clerk never copies changes from the reception cabinet back to the old one because the reception cabinet might have temporary notes that should not overwrite the official records. In this analogy, the old wooden filing cabinet is your on-premises Active Directory. The sleek metal cabinet is Microsoft Entra ID (the cloud directory). The clerk is Microsoft Entra Connect. The clerk’s daily copying routine is the synchronization cycle. If you install Entra Connect, it will regularly check your on-premises Active Directory for any changes to user accounts, group memberships, or passwords. It will then update Microsoft Entra ID with those changes, ensuring that cloud services like Microsoft 365 have the correct up-to-date user list. If a user changes their password on-premises, the clerk (Entra Connect) can optionally copy the hashed version of that password to the cloud, allowing the user to log into both systems with the same password. The clerk can also be told to only copy certain folders (like only users from the “Finance” organizational unit), which is like setting up filtering rules in Entra Connect.

## Why it matters

Microsoft Entra Connect matters because it is the foundational tool for enabling hybrid identity in organizations that use both on-premises Active Directory and Microsoft cloud services. Without it, IT administrators would have to manually create and maintain separate user accounts in both environments, leading to significant administrative overhead, higher risk of errors, and poor user experience. Users would have to remember two different sets of credentials or go through complex federation setups that are difficult to manage. Entra Connect automates the synchronization of identities, ensuring consistency across on-premises and cloud directories. This is especially important for organizations with hundreds or thousands of users, where manual management is impractical. From a security perspective, Entra Connect enables centralized password policies and allows organizations to use their existing on-premises identity infrastructure as the authoritative source, which is critical for compliance and audit requirements. It also enables scenarios like single sign-on, where users can access cloud applications without re-entering their credentials, improving productivity and reducing password fatigue. For IT professionals, understanding Entra Connect is essential because it touches nearly every other Microsoft cloud service, from Microsoft 365 and Azure to Dynamics 365 and Power Platform. Misconfigurations in Entra Connect can lead to authentication failures, duplicate identities, or security vulnerabilities. In practice, most enterprise deployments of Microsoft 365 rely on Entra Connect to synchronize users. Therefore, anyone pursuing a career in IT administration, especially in cloud or hybrid environments, needs a solid grasp of what Entra Connect does, how it works, and the different authentication options it supports.

## Why it matters in exams

Microsoft Entra Connect appears in several Microsoft certification exams, particularly those focused on identity, administration, and hybrid environments. For the Microsoft Identity and Access Administrator (SC-300) exam, Entra Connect is a core topic. Candidates must understand how to plan and implement hybrid identity using Entra Connect, including choosing the appropriate authentication method (PHS, PTA, Federation), configuring synchronization options, and troubleshooting sync issues. The Microsoft 365 Administrator (MS-102) exam also covers Entra Connect as a component of hybrid Microsoft 365 deployments. In this exam, questions often focus on prerequisites for installation, configuring synchronization scoping via domain/OU filtering, and managing user identity synchronization. The Azure Administrator (AZ-104) exam touches on Entra Connect in the context of managing Azure AD identities and hybrid scenarios, though less deeply than SC-300. For the newer Microsoft Windows Server Hybrid Administrator Associate (AZ-800 and AZ-801) exams, Entra Connect is an important piece of the hybrid identity puzzle, and candidates may see scenario-based questions requiring them to choose the correct tool for synchronizing identities between on-premises AD DS and Azure AD. Exam questions often present a scenario where a company is migrating to Microsoft 365 and asks which authentication method to use based on security requirements, or how to ensure password changes on-premises are reflected in the cloud. Objectives typically include understanding the difference between cloud-only and synchronized identities, the concept of the immutable ID, the role of the Microsoft Entra Connect Sync service account, and how to use the Microsoft Entra Connect wizard to perform a migration from DirSync or Azure AD Sync. Candidates should also be prepared to answer questions about the health and monitoring of synchronization using the Microsoft Entra Connect Health tool.

## How it appears in exam questions

In certification exams, Microsoft Entra Connect appears in several common question patterns. The first is the scenario-based question where a company is planning a hybrid deployment and needs to select the appropriate authentication method. For example, a question might describe an organization that requires passwords to never leave the on-premises network due to strict security policies. The correct answer would be Pass-Through Authentication (PTA). Another question might describe a scenario where users want to use the same password for both on-premises and cloud, and answer choices include PHS, PTA, and Federation. The correct answer depends on whether password hashes can be stored in the cloud (PHS) or not (PTA). Configuration questions are another common type. These might ask which step in the Entra Connect wizard is used to choose which OUs to sync, or which attribute is used as the source anchor. Candidates need to know that the source anchor is typically the objectGUID from on-premises AD DS, and that you can customize the attribute used if needed. Troubleshooting questions often present a sync failure scenario. For instance, a user created on-premises is not appearing in Microsoft 365, and the question asks what the first step should be. The answer might be to check the Microsoft Entra Connect synchronization service or run a delta sync using the PowerShell command “Start-ADSyncSyncCycle -PolicyType Delta.” Another pattern is the question about preventing on-premises changes from being overwritten by cloud changes. The answer typically involves understanding that the on-premises directory is authoritative by default, and that the Microsoft Entra Connect tool enforces this through attribute precedence. Finally, questions about the prerequisites for installing Entra Connect, such as required ports (TCP 443 for outbound communication), or the need for an on-premises server with .NET Framework and a SQL Server database (Express or full), are common in foundational-level exams. Learners should be familiar with the installation wizard's main steps, including the sign-in method selection, the sync filtering options, and the option to enable Seamless SSO.

## Example scenario

Consider a mid-sized company called “Northstar Engineering” with 500 employees. They have been using an on-premises Windows Server Active Directory for 15 years to manage all employee accounts, groups, and access permissions. Recently, the company decided to adopt Microsoft 365 for email (Exchange Online), Teams, and SharePoint Online. The IT team, led by a junior administrator named James, initially considered creating each user manually in Microsoft 365. However, they quickly realized that would mean updating two systems every time an employee joined, left, or changed roles. James learned about Microsoft Entra Connect and decided to install it on a dedicated Windows Server in the on-premises network. During installation, James selected “Password Hash Synchronization” because the company wanted users to use their existing on-premises passwords to log into Microsoft 365. He also enabled “Seamless Single Sign-On” so that users on domain-joined computers would not see a login prompt. James configured the sync to include only users in the “Employees” organizational unit, excluding service accounts and temporary contractors. After the initial sync completed, all 500 user accounts appeared in Microsoft 365 with the correct display names, email addresses, and group memberships. When a new engineer joined the following week, James added the user to the on-premises Active Directory. Within 30 minutes, the user appeared in Microsoft 365 and could log in using their on-premises password. When an employee left the company, disabling the account on-premises also disabled the Microsoft 365 account after the next sync cycle. The scenario illustrates how Entra Connect eliminates duplicate work, ensures consistency, and provides a seamless experience for both administrators and end users. However, James also learned that if someone changed their mobile phone number in the Microsoft 365 contact settings, the change would be overwritten by the next sync, because the on-premises directory was authoritative for that attribute.

## Common mistakes

- **Mistake:** Installing Microsoft Entra Connect on a Domain Controller
  - Why it is wrong: Microsoft strongly discourages installing Entra Connect on a domain controller because it increases the attack surface and can cause performance issues due to the SQL Server database that Entra Connect requires. A dedicated member server is recommended.
  - Fix: Install Entra Connect on a dedicated Windows Server that is a member of the domain but not a domain controller, with sufficient CPU, RAM, and disk space.
- **Mistake:** Thinking that Entra Connect syncs in both directions automatically
  - Why it is wrong: By default, Entra Connect synchronizes from on-premises AD DS to Microsoft Entra ID. Changes made directly in Microsoft Entra ID (like updating a user's phone number) can be overwritten by the next sync cycle, because the on-premises directory is authoritative.
  - Fix: Understand that Entra Connect is a one-directional sync from on-premises to cloud for most attributes, unless specific features like device writeback or Exchange hybrid writeback are configured.
- **Mistake:** Choosing Pass-Through Authentication without installing the PTA agent
  - Why it is wrong: Pass-Through Authentication requires one or more on-premises PTA agents to be installed and registered with Microsoft Entra ID. Simply selecting PTA in the wizard without installing the agent will cause authentication failures.
  - Fix: After selecting PTA during installation, follow the prompts to download and install the PTA agent on a separate server, and register it with your tenant.
- **Mistake:** Selecting Federation without having AD FS already configured
  - Why it is wrong: Choosing the Federation option in Entra Connect requires an existing AD FS infrastructure. The wizard cannot create the federation server itself; it can only configure the trust relationship with an existing farm.
  - Fix: Ensure that AD FS is deployed and properly configured before running the Entra Connect wizard with the Federation option. Alternatively, use PHS or PTA for simpler deployments.
- **Mistake:** Not checking the Synchronization Service Manager after initial sync
  - Why it is wrong: Many administrators assume the sync ran successfully without reviewing errors or warnings in the Synchronization Service Manager. Errors like permission issues or object conflicts can cause partial syncs and missing users.
  - Fix: Always open the Synchronization Service Manager after the initial sync to verify that import, sync, and export operations completed without errors. Check for any objects that failed to sync.

## Exam trap

{"trap":"The question states: “A company wants to sync user passwords to the cloud so users can use the same password for on-premises and Microsoft 365. They require that passwords never leave the on-premises network. Which authentication method should they choose?”","why_learners_choose_it":"Learners see “sync passwords” and immediately think of Password Hash Synchronization (PHS), without reading the second requirement that passwords never leave the on-premises network.","how_to_avoid_it":"Read the full question carefully. PHS does sync password hashes to the cloud, which means the password representation leaves the network. Pass-Through Authentication (PTA) validates passwords against the on-premises DC and never sends the password or its hash to the cloud. The correct choice is PTA."}

## Commonly confused with

- **Microsoft Entra Connect vs Azure AD Sync (DirSync):** Azure AD Sync (often called DirSync) was the predecessor to Microsoft Entra Connect. It lacked many features like PTA, Seamless SSO, and device writeback. Microsoft Entra Connect is the modern supported tool; DirSync is deprecated and no longer supported. (Example: If you see an exam question about a legacy tool that syncs users to Azure AD, the older one is DirSync, but the correct current answer is always Microsoft Entra Connect.)
- **Microsoft Entra Connect vs Microsoft Identity Manager (MIM):** MIM is a full-featured identity management platform that can synchronize between many different directories and databases, not just AD and Microsoft Entra ID. Entra Connect is a focused tool specifically for syncing on-premises AD to Microsoft Entra ID. MIM is more complex and expensive. (Example: For a simple hybrid Microsoft 365 deployment, you use Entra Connect. For complex identity scenarios involving multiple HR systems, LDAP directories, and databases, you might use MIM.)
- **Microsoft Entra Connect vs Pass-Through Authentication (PTA) agent:** The PTA agent is a component that Entra Connect installs to delegate authentication validation to on-premises servers. Entra Connect is the overall synchronization and configuration tool. The PTA agent is just a part of the authentication stack for one specific method. (Example: Entra Connect is like the main control panel that configures how identity flows work. The PTA agent is like a dedicated validator that checks passwords against the local directory when a cloud login occurs.)

## Step-by-step breakdown

1. **Preparation and Prerequisites** — Before installing Microsoft Entra Connect, the administrator must ensure that the target server runs a supported Windows Server version (2016 or later), has .NET Framework 4.6.2+, and has access to SQL Server (Express is auto-installed if not present). The server must be domain-joined, and the account used to run the wizard must have Enterprise Admin rights in the on-premises AD DS and access to the Global Admin account for the Microsoft Entra ID tenant. Network connectivity must allow outbound HTTPS (TCP 443) to Microsoft cloud endpoints.
2. **Choosing the Sign-In Method** — During the installation wizard, the administrator selects one of the authentication methods: Password Hash Synchronization (PHS), Pass-Through Authentication (PTA), or Federation (usually AD FS). This decision depends on security and compliance requirements. PHS is simplest and stores password hashes in the cloud. PTA keeps passwords on-premises. Federation adds a third-party identity provider. The wizard also offers options to enable Seamless Single Sign-On and password writeback.
3. **Configuring Directory Extension and Attribute Mapping** — The wizard asks which attributes from on-premises AD DS should be synchronized to Microsoft Entra ID. By default, a standard set of attributes is synced, including displayName, userPrincipalName, mail, and proxyAddresses. Administrators can add custom directory extensions if they have extended the schema. The source anchor (usually objectGUID) is automatically selected to uniquely identify each object during sync.
4. **Filtering Users and Groups** — To limit which objects are synced, administrators can choose domain/OU filtering, for example, syncing only the “Users” OU and excluding “Service Accounts.” Group-based filtering is also available. This step reduces the number of synced objects, improving performance and preventing unwanted cloud accounts from being created for service or test accounts.
5. **Running Initial Sync and Verification** — After configuration, the wizard performs an initial synchronization. This includes a full import of on-premises AD DS objects, a full import of Microsoft Entra ID objects, synchronization to the metaverse, and export to both directories. The administrator should open the Synchronization Service Manager to verify no errors occurred, and then log into the Microsoft Entra admin center to confirm users appear correctly.
6. **Setting Up Monitoring and Health** — Post-installation, it is important to set up monitoring via Microsoft Entra Connect Health. This tool provides alerts for sync failures, performance metrics, and insights into authentication health. Without monitoring, administrators may not notice a sync failure for days, leading to out-of-date cloud identities.

## Practical mini-lesson

Microsoft Entra Connect is not a set-it-and-forget-it tool; it requires ongoing attention and an understanding of its internal architecture. The synchronization engine is built on the Microsoft Identity Manager (MIM) framework, and it uses a concept called the “Metaverse.” Think of the Metaverse as a staging area where identity data from both on-premises AD DS and Microsoft Entra ID are brought together, compared, and merged. Each object in the Metaverse has a unique ID and holds attributes from both directories. The engine applies rules to determine which attribute value wins when there is a conflict. By default, the on-premises AD DS is the authoritative source, so if an attribute like “telephoneNumber” is set in both places, the on-premises value will be written to the cloud during sync. 

One critical but often overlooked aspect is the concept of the “ImmutableId.” When a user object is synced for the first time, the source anchor attribute (by default, the objectGUID from on-premises AD DS) is converted to a base64-encoded string and stored as the ImmutableId in Microsoft Entra ID. This ImmutableId ties the cloud object to its on-premises counterpart and cannot be easily changed after object creation. If an on-premises user is accidentally deleted and then re-created with a new objectGUID, the cloud user will not match and may become an orphaned object. Professionals must understand this to avoid hard-to-fix sync issues. 

Another practical consideration is the performance of the sync cycle. By default, a delta sync runs every 30 minutes. For large directories with over 100,000 objects, full imports can take hours. Administrators can tweak the sync schedule using PowerShell or by modifying the scheduler, but they must be careful not to overload the network or the server. The tool supports staging mode, which is useful for testing. In staging mode, Entra Connect runs normally but never exports any changes to the cloud. This allows administrators to verify that the sync is correct before enabling real exports. 

Finally, professionals should know how to perform a full resync if needed, using the command “Set-ADSyncScheduler -FullSyncRequired $true”. This forces the next sync cycle to be a full import and export, which can resolve many corruption or inconsistency issues. However, it is heavy on resources and should be used sparingly.

## Memory tip

Remember “P-F-P” for the three sign-in methods: P for Password Hash Sync (cloud hashes), F for Federation (external IDP), and P for Pass-Through (on-premises validation).

## FAQ

**Is Microsoft Entra Connect free?**

Yes, Microsoft Entra Connect is a free tool provided by Microsoft. However, it requires a Windows Server license and a Microsoft Entra ID subscription (free tier includes up to 500,000 objects) to use the cloud directory.

**Can I use Microsoft Entra Connect without an on-premises Active Directory?**

No. Microsoft Entra Connect is designed specifically to synchronize from on-premises Active Directory Domain Services (AD DS) to Microsoft Entra ID. If you don't have an on-premises AD, you can manage users directly in Microsoft Entra ID as cloud-only identities.

**What happens if the sync fails?**

If the sync fails, cloud user accounts and groups will become outdated. Microsoft Entra Connect Health can send alerts. You can manually trigger a delta sync using the PowerShell command or the Synchronization Service Manager to attempt recovery.

**Can I sync password changes immediately?**

Not instantly by default. Password changes are synced during the next delta sync cycle, which runs every 30 minutes. However, if you have selected Password Hash Sync, you can trigger an immediate delta sync using PowerShell to speed up the process.

**What is the difference between a full sync and a delta sync?**

A delta sync synchronizes only the changes that occurred since the last sync (e.g., new users, password changes). A full sync re-processes all objects from both directories, which is much more resource-intensive and is typically only used for initial setup or to resolve corruption.

**Does Microsoft Entra Connect support syncing multiple forests?**

Yes, Microsoft Entra Connect supports syncing multiple on-premises Active Directory forests. You can configure it during installation by providing credentials for each forest. This is common in organizations with merged IT infrastructures or separate resource forests.

## Summary

Microsoft Entra Connect is the essential bridge between on-premises Active Directory and Microsoft Entra ID, enabling hybrid identity for organizations using Microsoft cloud services. It automates the synchronization of user accounts, groups, and passwords, eliminating the need for duplicate management. The tool supports three main authentication methods, Password Hash Synchronization, Pass-Through Authentication, and Federation, giving administrators flexibility based on security and compliance requirements. Understanding how to install, configure, and troubleshoot Entra Connect is critical for IT professionals working in hybrid environments. It appears prominently in Microsoft certification exams related to identity (SC-300), Microsoft 365 administration (MS-102), and hybrid server administration (AZ-800/AZ-801). Common exam topics include choosing the right authentication method, understanding sync behavior, and troubleshooting sync failures. The practical takeaway is that Entra Connect is not a one-time setup but requires monitoring and occasional maintenance, especially as the organization’s directory evolves. For anyone pursuing a career in modern IT, mastering Microsoft Entra Connect is a foundational skill that supports nearly every Microsoft cloud service.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/microsoft-entra-connect