If your users live in on-premises Active Directory, you need a way to sync them to Microsoft Entra ID for Microsoft 365. Microsoft gives you two options: Entra Connect Sync and Entra Cloud Sync.
Short answer: choose Cloud Sync for new or simpler environments, multi-forest mergers and high availability. Choose Connect Sync when you need advanced features such as pass-through authentication, complex attribute rules or device writeback.
Entra Connect Sync vs Cloud Sync at a Glance
| Capability | Entra Connect Sync | Entra Cloud Sync |
|---|---|---|
| Installation | Full sync engine on a Windows server | Lightweight provisioning agent |
| Configuration | On the server | In the Entra admin center |
| High availability | Staging server (manual failover) | Multiple active agents |
| Disconnected forests | Limited | Supported |
| Password hash sync | Yes | Yes |
| Pass-through authentication | Yes | No |
| Device writeback and advanced rules | Yes | Limited |
| Large directories | Strong | Check current limits |
Microsoft adds Cloud Sync features regularly, so check the current comparison in Microsoft’s documentation before deciding.
When to Choose Cloud Sync
- New hybrid identity setups with standard needs.
- Mergers and acquisitions where forests are not connected.
- You want sync to keep running if a server fails.
- You want less server maintenance.
When to Stay on Connect Sync
- You use pass-through authentication.
- You rely on custom sync rules or complex filtering.
- You need device writeback or certain Exchange hybrid scenarios.
- You have a very large directory with advanced requirements.
Choosing an Authentication Method
Sync and sign-in are separate decisions. For most organizations, password hash sync is the simplest and most resilient method, and it enables leaked credential detection. Combine it with MFA and Conditional Access, as described in our Conditional Access best practices.
How to Migrate From Connect Sync to Cloud Sync
- Check that Cloud Sync supports every feature you use today.
- Install Cloud Sync agents and create a configuration scoped to a pilot OU.
- Remove the same OU from Connect Sync scope.
- Validate users, groups and password sync.
- Expand in phases, then decommission Connect Sync.
Common Hybrid Identity Mistakes
- Running an unsupported Connect Sync version.
- Syncing service and admin accounts that should stay cloud-only or on-prem only.
- No monitoring, so sync errors go unnoticed.
- Weak security on the sync server, which is a Tier 0 asset.
A clean Active Directory makes sync far easier. See our Active Directory design and hardening services.
Get Hybrid Identity Right
M365 Enterprise Hub designs and runs hybrid identity for organizations across the UAE and Saudi Arabia. Explore our hybrid identity setup, hybrid AD expertise and Entra ID migration services, or read our guide to identity and access management in Microsoft 365. Book a free hybrid identity review.
Frequently Asked Questions
What is the difference between Entra Connect Sync and Cloud Sync?
Entra Connect Sync is a full sync engine installed on a Windows server. Cloud Sync uses lightweight agents and is configured from the cloud. Connect Sync supports more advanced scenarios, while Cloud Sync is simpler and supports disconnected forests.
Which one does Microsoft recommend?
Microsoft recommends Cloud Sync for new deployments when it supports all the features you need. Connect Sync remains the choice for advanced scenarios such as pass-through authentication or some Exchange hybrid needs.
Can I run Connect Sync and Cloud Sync together?
Yes, in some designs. For example, you can use Cloud Sync for a newly acquired forest while keeping Connect Sync for the main forest, as long as the same objects are not synced by both.
Does Cloud Sync support password hash synchronisation?
Yes. Both tools support password hash sync, which is the recommended authentication method for most organizations.
Does Cloud Sync support pass-through authentication?
No. Pass-through authentication requires Entra Connect Sync.
Is Cloud Sync highly available?
Yes. You can install multiple lightweight agents, so sync continues if one server goes offline.
Do I still need Active Directory after setting up sync?
Yes, while AD is your source of identity. Many organizations later move to cloud-only identity once apps and devices no longer depend on AD.