Hybrid identity comes up in nearly every Entra ID project I work on. Clients might be moving to the cloud, merging with another company or just modernising their on-premises setup, but sooner or later the same decision lands on the table. Do they stay with the traditional Entra Connect Sync, or is it finally time for Entra Cloud Sync? I get asked this more and more, partly because cloud-centric approaches have become more attractive and partly because existing connectors are getting harder to keep secure and reliable.

Entra Cloud Sync appeals because it needs only lightweight agents on premises

Entra Cloud Sync has gained a lot of ground recently. The configuration now lives entirely in the cloud, so what's left on premises is a set of lightweight provisioning agents on Windows Server. You no longer maintain a full SQL Server instance just to sync identities, and installing or updating the agents is quick and (mostly) hands-off. High availability gets much easier as well. You deploy additional agents as needed, and if one goes offline, the others keep syncing. For small and mid-sized organisations that alone can make a real difference.

What made Cloud Sync really interesting for me is its support for disconnected forests. I run into this constantly after mergers or acquisitions, when separate Active Directory forests have to be connected to the same Entra ID tenant. With Cloud Sync you can connect those environments securely and in parallel, without complex trust relationships or custom scripts. If you want the details on how it works and which scenarios it covers, Microsoft's Cloud Sync overview is a good place to start.

Entra Connect Sync still covers features that Cloud Sync lacks

Cloud Sync can't fully replace Connect Sync yet, though. Whenever I review a hybrid identity scenario, I go back to the feature comparison table to confirm what's actually supported. Connect Sync is still required in several cases:

  • Device writeback for hybrid device management
  • Exchange hybrid writeback for certain attributes
  • Pass-through authentication (PTA)
  • Large directories with advanced filtering, transformations or mappings
  • Custom sync rules

So if you depend on hybrid Exchange attributes, on device management that needs writeback, or on complex directory transformations, Connect Sync isn't going anywhere for you. In very large or intricate environments it can also perform better. That's one more reason I'd keep both options open for now.

You can pilot Cloud Sync side by side with Connect Sync

You also don't have to migrate everything in one go. Microsoft supports running Cloud Sync and Connect Sync side by side, provided the pilot only syncs a test OU or a subset of users and groups. I find this very useful for validating mappings and testing migration strategies for new departments or forests from a merger. Microsoft has a detailed walkthrough in the Cloud Sync pilot tutorial for dual sync.

A typical multi-forest Cloud Sync setup looks like this:

flowchart TD
    AD1["On-Prem AD Forest 1"] --> Agent1["Cloud Sync Agent"]
    AD2["On-Prem AD Forest 2"] --> Agent2["Cloud Sync Agent"]
    Agent1 --> CloudSync["Entra Cloud Sync (Cloud Service)"]
    Agent2 --> CloudSync
    CloudSync --> EntraID["Entra ID"]

Figure: Multiple AD forests connected to Entra ID through Cloud Sync agents.

I've now used this approach in several projects to migrate step by step without disrupting production. It also gives you room to test mappings and scope properly before you commit to a full cutover.

Sync servers deserve the same maintenance and security as any Tier 0 asset

Identity sync belongs to the most sensitive Tier 0 assets in any environment. Even so, I still find Connect Sync servers that are years behind on updates or sit on unpatched, overloaded infrastructure. Microsoft is pushing automatic updates harder and retiring older builds, so keeping Connect Sync current is simply mandatory.

Practical tip: Run your sync servers with only the privileges they actually need, don't install extra roles or services on them, and check local admin membership on a regular basis.

Cloud Sync takes some of the load off your servers, but that doesn't make the agent servers low risk. Patch and protect them just as carefully, even though there's less to manage.

Cloud Sync is pulling ahead in my projects

Over the past year, more and more of the organisations I work with have chosen Entra Cloud Sync for new use cases, particularly after mergers or when bringing new sites on board. Easy deployment, configuration in the cloud and simple high availability are what win them over. If you don't need hybrid Exchange, device writeback, PTA or highly customised filtering, Cloud Sync is usually the more modern option and the easier one to maintain. If you're also getting ready for services like Copilot, take a look at my post on [/blog/copilot-for-microsoft-365-tenant-readiness], because identity and governance requirements keep shifting.

In the end, the right choice depends on the scenario. Cloud Sync is mature enough for many cases, while Connect Sync still has a place for specific requirements. If you're planning a new hybrid setup in 2024, compare the features and check your requirements first. Either way, hybrid identity is clearly getting a lot simpler.