Microsoft's Guided Migration Path from Entra Connect Sync to Cloud Sync

Why this matters for SMB admins

If your organization synchronizes on-premises Active Directory to Microsoft Entra ID, you’re likely using either Microsoft Entra Connect Sync (the older, on-premises synchronization server) or Microsoft Entra Cloud Sync (the newer, cloud-managed synchronization service built around a lightweight on-premises agent). Microsoft has published official guidance describing Cloud Sync as its strategic direction for hybrid identity synchronization, and it has released a guided migration tool specifically designed to move eligible organizations from Connect Sync to Cloud Sync.

For SMB administrators, this matters for two reasons. First, the guided tool can significantly simplify a migration that was previously a manual, multi-step process. Second, the tool’s current eligibility rules and object-scope limits mean it won’t be available or suitable for every environment yet, so it’s worth understanding both the guided path and the documented manual path before you plan a project.

This article summarizes what Microsoft’s approved documentation currently says about the migration tool, its prerequisites, its readiness checks, and its limitations, along with the manual migration process Microsoft documents as an alternative.

What the guided migration tool does

According to Microsoft’s documentation, the guided migration tool is launched directly from the Microsoft Entra Connect Sync wizard on the active Connect Sync server, through Configure > Transition to Cloud Sync. Once started, it walks an administrator through five broad stages:

1. Environment readiness review – assesses domains, scope, enabled features, authentication settings, writeback settings, object limits, and any existing Cloud Sync agents or configurations.
2. Configuration transfer – automatically creates the required Cloud Sync configuration and synchronization jobs, while the new configuration remains disabled and Connect Sync stays active.
3. Provision on Demand verification – lets you test a representative object in each migrated domain configuration before anything goes live.
4. Activation – switches the active synchronization path from Connect Sync to Cloud Sync, placing Connect Sync into staging mode.
5. Post-activation validation – compares aggregate object counts and Cloud Sync job health between the two systems.

This is a documented, Microsoft-built workflow rather than a conceptual plan — it is described as a wizard with specific screens or steps at each stage.

Prerequisites for using the migration tool

Microsoft’s documentation lists several prerequisites that must be in place before the tool can be used:

• An account with the Hybrid Identity Administrator role to connect to Microsoft Entra and manage Cloud Sync configurations.
• Domain Admin credentials for every selected Active Directory forest, which the wizard uses to validate access and configure the group managed service account (gMSA) for the provisioning agent.
• A supported version of Connect Sync — Microsoft notes that the migration option only appears for organizations and Connect Sync installations eligible for “the current migration wave.”
• Access to the active Connect Sync server; the tool cannot be run from a server that is in staging mode.
• A commitment to keep Connect Sync installed for a two-week validation period after migration.

The tool supports transferring user synchronization, group synchronization, password hash synchronization (PHS), password writeback, Exchange hybrid writeback, and supported domain/OU scoping configurations.

Eligibility and timing: no fixed public date

One important nuance for planning purposes: the supplied documentation does not state a specific public rollout date, nor a universal deadline for all organizations. Instead, Microsoft describes eligibility in terms of a “current migration wave,” and states that eligible organizations are notified individually through in-product experiences and email, with the notification identifying that organization’s own migration window or deadline.

In practical terms, this means SMB admins should not assume a single industry-wide cutoff date exists. If your organization receives a notification, that notification — not a general announcement — defines your specific window.

Environment limits that currently gate the tool

The migration tool currently only supports environments that meet specific scope limits, as documented by Microsoft:

• A single Active Directory forest with no more than 2,000 in-scope objects.
• Additive OU inclusion scoping with no more than 30 included containers per domain.
• No migration-blocking features present, such as custom synchronization rules, group filtering, a custom user principal name (UPN), directory extensions, device synchronization, or unsupported writeback scenarios.

It’s worth distinguishing these migration-tool limits from Cloud Sync’s broader service-level scale figures. Microsoft’s separate migration decision guide states that Cloud Sync, as a service, currently supports up to 150,000 objects per domain and groups with up to 50,000 members — these are architecture-level limits for Cloud Sync generally, not the much smaller scope the current migration tool can process in one pass. If your organization exceeds the tool’s 2,000-object or 30-container limits, you may still be able to use Cloud Sync — just not necessarily through the automated tool in its current form.

Readiness checks built into the tool

During the readiness review stage, the wizard checks (among other things):

• In-scope domains and object counts
• Enabled features and authentication-related settings
• Writeback settings
• Existing Cloud Sync agents or configurations
• Unsupported synchronization rules
• The Connect Sync accidental-deletion protection setting and deletion threshold

Microsoft’s documentation is explicit that if this review blocks migration, administrators should not attempt to bypass the result — instead, remediate the identified condition or wait until the required capability becomes available.

After the readiness review, the wizard transfers configuration settings and then requires a Provision on Demand check for a representative test user or group in each migrated domain before you can proceed to activation. Microsoft specifically advises reviewing the detailed provisioning result rather than relying only on the final success indicator.

Validation after activation

After activation, Connect Sync is placed into staging mode (it continues import/synchronization processing locally but stops exporting to Microsoft Entra ID), and Cloud Sync becomes the active synchronization path. The validation page in the wizard automatically compares an aggregate “Total Objects” count and checks Cloud Sync job health, but Microsoft is clear that it does not automatically validate individual users, groups, memberships, or writeback operations — manual verification of these is still required.

Microsoft’s documented guidance also specifies keeping Connect Sync installed for the full two-week validation period, and explicitly cautions against uninstalling it during initial validation.

Requesting more time or an exception

For organizations that receive a migration notification but face a genuine blocker, Microsoft’s documentation describes a formal exception process: opening a Microsoft Support request for a temporary Cloud Sync migration exception. According to the documentation, these exceptions:

• Are reviewed individually
• Are not guaranteed
• Do not remove the underlying requirement to eventually migrate

The support request should include the tenant ID, a requested exception end date with justification, the readiness report and description of the confirmed blocking condition, expected business impact, mitigations already attempted, and a migration plan with milestones. Microsoft’s guidance also stresses submitting evidence only through the secure Support channel and redacting credentials, secrets, and other sensitive data before uploading any logs or screenshots.

The manual migration path (for everyone else)

Not every organization will be eligible for, or ready to use, the automated tool right away — for example, if your environment exceeds the current object/OU limits, uses a migration-blocking feature, or simply hasn’t received an eligibility notification yet. For these cases, Microsoft documents a separate, manual phased migration process that predates the guided tool.

This manual approach uses custom Connect Sync synchronization rules — specifically a cloudNoFlow inbound rule and a JoinNoFlow outbound rule — to stop Connect Sync from exporting object adds, deletes, and non-reference attribute updates for objects you’re migrating, while still allowing reference attributes like group membership (member) and manager (manager) to flow for resolution during the coexistence period.

Key points from Microsoft’s documented manual process:

• You migrate users, groups, and related objects in batches (for example, by organizational unit), keeping each batch in Connect Sync scope with the no-flow rules applied until that batch is fully migrated and ready for cutover.
• Microsoft explicitly warns against removing objects from Connect Sync scope during the pilot or coexistence phase, because doing so can drop references in the Microsoft Entra connector space and export unintended reference deletes — such as group membership removals — to Microsoft Entra ID.
• Only after you’ve verified that Cloud Sync is provisioning all affected objects correctly, and that references like group memberships remain intact, should you remove that batch’s scope from Connect Sync as part of final cutover.
• Microsoft recommends leaving the Connect Sync server in a disabled state for a period of time after cutover so you can verify the migration succeeded before decommissioning it.

The pilot tutorial

Microsoft also publishes a hands-on tutorial for testing this manual approach in a non-production, test Active Directory forest. Its documented prerequisites include:

• Microsoft Entra Connect Sync version 1.4.32.0 or later
• A server running Windows Server 2022, 2019, or 2016 to host the provisioning agent
• A source anchor of either objectGuid or ms-ds-consistencyGUID for Connect Sync
• Objects in the pilot scope having ms-ds-consistencyGUID populated (note: Connect Sync doesn’t populate this by default for group objects, so this may require extra preparation)

Microsoft describes this tutorial as scoped to a basic test-forest scenario and recommends reviewing the full production migration documentation separately before attempting a real migration.

Using the decision guide to assess readiness

Before committing to either path, Microsoft’s migration decision guide offers a structured self-assessment. According to this guide, an organization is positioned for immediate migration if it meets criteria such as:

• Fewer than 150,000 objects per Active Directory domain
• Groups with fewer than 50,000 members
• Device sync planned separately if hybrid join is in use
• Password Hash Sync, or ADFS/PTA managed separately from sync
• OU-based filtering rather than complex attribute-based rules
• A single forest or connected forests (no disconnected-forest requirements)

Organizations with more complex requirements — such as advanced attribute-based filtering, cloud-to-AD user provisioning needs, very large object/group scale, extensive custom sync rules, or cross-forest dependencies — are advised by Microsoft to plan for near-term or future migration depending on feature availability and business cycles, rather than migrating immediately.

The decision guide’s feature comparison table also documents some capabilities that are not available in Cloud Sync today, including advanced sync rules (Cloud Sync uses an expression builder instead), cross-forest references, attribute merging from multiple domains, and out-of-band reconciliation — all of which remain supported in Connect Sync.

Practical recommendations for SMB admins

The following suggestions are practical governance guidance, not documented Microsoft requirements:

• Check your environment against both limit sets separately. Compare your object counts and OU structure against the migration tool’s current 2,000-object/30-container ceiling, and separately against Cloud Sync’s general 150,000-object/50,000-member service limits, since these serve different purposes.
• Don’t wait passively for a notification if you’re already a good candidate. Reviewing the decision guide’s “ready for immediate migration” criteria now can help you plan ahead, whether or not the automated tool has reached your tenant yet.
• Treat the two-week validation window as a real operational commitment, not a formality — budget staff time to manually check users, groups, and writeback scenarios during that period, since the tool’s automatic validation only checks aggregate counts and job health.
• If you anticipate a blocker, start gathering the documentation Microsoft requests for an exception request (readiness report, blocker description, mitigation history, and a migration plan) well before any deadline arrives.
• If you’re using the manual migration path, be deliberate about scope removal — Microsoft’s documentation repeatedly highlights that premature scope removal from Connect Sync is a leading cause of unexpected reference deletes, such as group membership loss.

Conclusion

Microsoft has released a genuinely guided migration path from Entra Connect Sync to Cloud Sync, complete with an automated readiness review, configuration transfer, pre-activation verification, and post-activation validation steps. However, this guided tool is currently gated by eligibility (a “migration wave” with individualized notifications) and by fairly tight environment limits — 2,000 in-scope objects and 30 included containers per domain — that are separate from Cloud Sync’s broader service-level capacity.

For organizations outside the tool’s current scope, Microsoft continues to document a manual, rule-based migration process and a pilot tutorial that allow for a controlled, phased transition. Whichever path applies to your organization, the decision guide’s readiness criteria are a useful starting point for assessing whether — and how soon — a move to Cloud Sync makes sense. As with any identity infrastructure change, this draft should be reviewed against your current environment and Microsoft’s latest documentation before you begin planning an actual migration.