3.3 Microsoft Entra Cloud Sync & Disconnected Multi-Forest Topologies

Microsoft Entra Cloud Sync & Disconnected Multi-Forest Topologies

As enterprise organizations evolve through global expansion, corporate divestitures, and mergers and acquisitions (M&A), identity architectures often span multiple disparate Active Directory forests. Traditional Microsoft Entra Connect Sync requires a heavyweight on-premises server footprint with line-of-sight network connectivity to every domain controller across all synchronized forests.

Microsoft Entra Cloud Sync represents a modern, cloud-first synchronization paradigm that moves the synchronization rules engine, metaverse processing, and transformation logic into the Microsoft Entra ID cloud service, utilizing lightweight on-premises provisioning agents to bridge isolated directories.

---

1. Microsoft Entra Cloud Sync Architecture

Unlike traditional Entra Connect Sync where the synchronization engine and database reside on a dedicated Windows Server on-premises, Microsoft Entra Cloud Sync decouples the data collection mechanism from the synchronization compute engine.

+-----------------------------------------------------------------------------------+
|               MICROSOFT ENTRA CLOUD SYNC MULTI-FOREST ARCHITECTURE                |
|                                                                                   |
|  +------------------------------------------------------------------------------+ |
|  |                         MICROSOFT ENTRA ID CLOUD                             | |
|  |  - Cloud Synchronization Engine & Metaverse                                  | |
|  |  - Expression-Based Attribute Mapping Engine                                 | |
|  |  - Portal-Managed Scoping Filters & Monitoring                               | |
|  +------------------------------------------------------------------------------+ |
|             ^ (Outbound HTTPS 443)                           ^ (Outbound HTTPS 443)|
|             |                                                |                    |
|  +---------------------------+                  +---------------------------+     |
|  |   FOREST A: CORP (HQ)     |                  | FOREST B: ACQUIRED ENTITY |     |
|  |  [Provisioning Agent 01]  |                  |  [Provisioning Agent 03]  |     |
|  |  [Provisioning Agent 02]  |                  |  [Provisioning Agent 04]  |     |
|  |  (High Availability Group)|                  |  (Isolated Perimeter)     |     |
|  +---------------------------+                  +---------------------------+     |
|   * No Forest Trust Required *                   * No Network VPN Required *      |
+-----------------------------------------------------------------------------------+

Core Architectural Characteristics:

1. Cloud-Hosted Metaverse & Sync Engine: All attribute precedence, mapping logic, object reconciliation, and join rules execute within the Microsoft Entra ID cloud control plane. On-premises servers do not require SQL Server instances or extensive RAM/CPU resources.
2. Lightweight On-Premises Provisioning Agent: A minimal service (AADConnectProvisioningAgent.exe) installed on a domain-joined Windows Server 2016/2019/2022. The agent communicates strictly outbound over HTTPS (port 443) to the cloud provisioning service.
3. Rapid Synchronization Frequency: Cloud Sync processes changes in continuous micro-batches every 2 minutes, dramatically reducing attribute propagation latency compared to Entra Connect Sync's default 30-minute sync cycle.
4. Built-In High Availability: Multiple provisioning agents can be installed in the same Active Directory domain. The cloud service automatically distributes workload and manages failover across active agents without requiring failover clustering or manual Staging Mode promotion.

Comprehensive Feature Matrix: Entra Connect Sync vs. Entra Cloud Sync

2. Disconnected Multi-Forest & Merger/Acquisition Scenarios

A primary architectural driver for deploying Microsoft Entra Cloud Sync is integrating isolated, non-routable, or disconnected Active Directory forests into a single centralized Microsoft Entra tenant.

M&A Deployment Blueprint:

When an organization acquires a subsidiary with an existing Active Directory forest (subsidiary.local):

1. Traditional Connect Sync Challenge: To use traditional Entra Connect Sync, network engineers would need to establish site-to-site IPsec VPNs or ExpressRoute connections, configure complex DNS conditional forwarders, resolve overlapping IP address spaces (NAT), and open extensive firewall ports (TCP 389, 636, 88, 53, 445, 135, 49152-65535) between the sync server and the subsidiary DCs.
2. Cloud Sync Solution: The administrator simply deploys two lightweight provisioning agents onto domain member servers inside the subsidiary's network. The agents establish outbound HTTPS connections over TCP port 443 to Microsoft Entra ID. No site-to-site VPN, no forest trusts, and no inbound firewall openings are required.

+-----------------------------------------------------------------------------------+
|              COEXISTENCE: CONNECT SYNC AND CLOUD SYNC IN ONE TENANT               |
|                                                                                   |
|  +------------------------------------------------------------------------------+ |
|  |                         SINGLE MICROSOFT ENTRA TENANT                        | |
|  +------------------------------------------------------------------------------+ |
|             ^                                                ^                    |
|             | (Connect Sync Pipeline)                        | (Cloud Sync Agent) | |
|  +--------------------------+                   +---------------------------+     |
|  |     HQ FOREST (CORP)     |                   |  ACQUIRED DISCONNECTED    |     |
|  | - 80,000 Users           |                   |         FOREST            |     |
|  | - Device Writeback       |                   | - 12,000 Users            |     |
|  | - Exchange Hybrid        |                   | - Password Hash Sync      |     |
|  +--------------------------+                   +---------------------------+     |
|                                                                                   |
|  CRITICAL RULE: Never synchronize the same OU or object with BOTH tools.         |
+-----------------------------------------------------------------------------------+

[!WARNING] Dual-Homed Synchronization Conflict: While Entra Connect Sync and Entra Cloud Sync can coexist within the same Microsoft Entra tenant, a single user or group object must never be in scope for both synchronization engines simultaneously. Dual-scoping creates severe attribute conflicts, identity flapping, and corrupted Metaverse anchor bindings.

---

3. Provisioning Agent Network Requirements & Troubleshooting

Provisioning agents require reliable outbound connectivity to Microsoft Entra cloud endpoints.

Network and Firewall Rules:

• Outbound Ports Only: TCP Port 443 (HTTPS) and TCP Port 80 (used strictly for downloading certificate revocation lists [CRLs] and OCSP validation during TLS handshakes).
• No Inbound Ports: No incoming firewall ports are ever opened on the on-premises perimeter.
• Key Endpoint FQDNs:
  • *.msappproxy.net
  • *.servicebus.windows.net
  • login.microsoftonline.com
  • mscrl.microsoft.com:80 and crl.microsoft.com:80

Troubleshooting Agent Connectivity:

If a provisioning agent fails to appear as Active in the Microsoft Entra admin center:

1. Verify Windows Service Status: Ensure the service Microsoft Entra Connect Agent Updater and Microsoft Entra Connect Provisioning Agent are running under the configured Group Managed Service Account (gMSA) or virtual account.
2. Review Trace Logs: Inspect the primary agent log located on the host server at: C:\ProgramData\Microsoft\Azure AD Connect Provisioning Agent\Trace\AADConnectProvisioningAgent.log
3. Event Viewer Channels: Navigate to Applications and Services Logs > Microsoft > Azure AD Connect > ProvisioningAgent > Admin for detailed TLS handshake errors, network proxy authentication failures, or expired tenant registration tokens.
4. PowerShell Diagnostics: Utilize the built-in diagnostic module to test end-to-end communication with Microsoft cloud service bus endpoints:

# Importing and running the Cloud Sync Agent Diagnostic Tool
Import-Module "C:\Program Files\Microsoft Azure AD Connect Provisioning Agent\Utility\Diagnostics\Microsoft.AzureADConnect.ProvisioningAgent.Diagnostics.dll"
Test-AADCloudSyncAgentConnectivity

---

4. Scoping Filters & Expression-Based Attribute Mappings

In Microsoft Entra Cloud Sync, attribute transformations and object scoping are configured entirely within the Microsoft Entra Admin Center under Identity > Hybrid management > Microsoft Entra Connect > Cloud sync.

Scoping Filters:

Scoping filters restrict synchronization based on:

• Organizational Unit (OU): Target specific distinguished names (e.g., OU=Users,OU=NorthAmerica,DC=corp,DC=contoso,DC=com).
• Attribute-Based Scoping: Filter objects based on attribute expressions (e.g., synchronizing only objects where department EQUALS 'Engineering' or extensionAttribute1 IS NOT NULL).

Common Transformation Functions:

+-----------------------------------------------------------------------------------+
|                   CLOUD SYNC TRANSFORMATION EXPRESSION EXAMPLES                   |
|                                                                                   |
|  1. Stripping Whitespace:                                                         |
|     StripSpaces([userPrincipalName])                                              |
|                                                                                   |
|  2. Conditional Fallback:                                                         |
|     IIF(IsNullOrEmpty([mail]), [userPrincipalName], [mail])                       |
|                                                                                   |
|  3. Constructing Composite UPN:                                                   |
|     Join("@", NormalizeDiacritics(StripSpaces([sAMAccountName])), "contoso.com") |
|                                                                                   |
|  4. Substring Extraction:                                                         |
|     Mid([department], 1, 3)                                                       |
|                                                                                   |
|  5. DateTime Formatting:                                                          |
|     FormatDateTime([accountExpires], "yyyyMMddHHmmss.0Z")                         |
+-----------------------------------------------------------------------------------+

[!TIP] Testing Attribute Expressions Safely: Use the Provision on Demand feature in the Entra Cloud Sync portal. Enter the distinguished name of a single on-premises user to simulate attribute mappings and view immediate step-by-step evaluation results before saving the configuration for the entire directory.