Entra Cloud Sync or Entra Connect Sync: choosing your synchronisation engine
For years, synchronising Active Directory with Entra ID meant installing Entra Connect, formerly Azure AD Connect. Microsoft is now promoting Entra Cloud Sync, which is lighter and managed from the cloud. The two tools do not cover exactly the same needs, and "lighter" does not mean "less sensitive".
Two different architectures
Entra Connect Sync is a full application installed on a Windows server: sync engine, local database, editable synchronisation rules and configuration wizard. All the logic runs on premises. High availability relies on a staging server ready to take over.
Entra Cloud Sync relies on a lightweight provisioning agent installed on premises. Configuration and the sync engine are hosted in Entra ID; the agent simply carries out operations against Active Directory. Several agents can be installed for high availability, and a single configuration can cover forests that are not connected to each other.
What each one can do
The feature set changes regularly, and Microsoft publishes a comparison matrix that should be checked before any decision. As a rough guide:
| Need | Connect Sync | Cloud Sync |
|---|---|---|
| Synchronising users, groups and contacts | Yes | Yes |
| Password hash synchronization | Yes | Yes |
| Pass-through authentication and federation integration | Yes | No |
| Syncing device objects for hybrid join | Yes | No, check as the product evolves |
| Disconnected forests | Complex | Yes |
| Advanced synchronisation rules | Yes | More limited |
The two tools can coexist, each on a separate scope: this is often the best option for bringing in a subsidiary or an acquired forest without changing the existing setup.
The security footprint
Whichever tool you use, synchronisation is a direct path between Active Directory and the cloud. With Connect Sync, the server hosts an Active Directory service account which, when PHS is enabled, holds directory secret replication rights, as well as the credentials used to write to Entra ID. Compromising it gives access to both worlds.
With Cloud Sync, the agent runs under a group managed service account that also receives extensive rights, including secret replication when PHS is used. Since the configuration lives in the cloud, the server holds fewer sensitive items, but whoever controls it controls the agent. And the synchronisation configuration can now be changed by Entra ID administrators with the appropriate role: that role must be kept under control.
Tier 0 either way. A Connect Sync server and a server hosting a Cloud Sync agent must both be administered from Tier 0, with the same level of protection as a domain controller. Adding agents for high availability also adds servers to protect.
Choosing and migrating
For a new project with no need for pass-through authentication, federation or complex rules, Cloud Sync is a natural choice. For an existing environment, the migration needs preparation:
- check the feature matrix against actual usage, especially hybrid join and custom attributes;
- test on a pilot organisational unit, removing that scope from Connect Sync so that no object is ever managed by both tools;
- confirm that objects keep their source anchor and are not recreated;
- expand gradually, then cleanly decommission the Connect Sync server and its service accounts.
What an audit checks
- The tool in use, its version and the synchronised scope.
- The protection level of sync servers or agents.
- The rights held by service accounts in Active Directory.
- The Entra ID accounts allowed to change the synchronisation configuration.
- That no object is managed by both tools at the same time.