8.2 Directory Sync with Entra Connect Sync & Cloud Sync

Directory Sync with Entra Connect Sync & Cloud Sync

Quick Answer: Microsoft ships two sync engines. Entra Connect Sync is the established on-premises server with the metaverse and Synchronization Service Manager. Entra Cloud Sync is the newer, lightweight provisioning-agent model that runs sync logic in the cloud. For new deployments without federation, Cloud Sync is Microsoft's recommended path; Connect Sync is required for AD FS federation, device sync, and several write-back features.

Entra Connect Sync (the traditional engine)

Microsoft Entra Connect Sync installs on a dedicated Windows Server you domain-join. Its architecture has three layers:

• Connector spaces — staged copies of objects from each connected directory (one for on-prem AD, one for Entra ID)
• The metaverse — the in-memory join of all connector spaces; the canonical object once duplicates are joined
• Synchronization rules — direction-aware rules that flow attributes inbound and outbound, with precedence resolving conflicts

You operate it with the Synchronization Service Manager (miisclient.exe), where you run import/sync/export profiles, inspect connectors, and trace object flow. A built-in scheduler runs a delta sync every 30 minutes by default; you can force a full or delta cycle manually.

Key features only Connect Sync offers today include AD FS federation configuration, device sync (Hybrid Azure AD Join write-back), password writeback, group writeback, and exchange hybrid with write-back of on-prem attributes. Custom sync-rule scenarios — where you author your own inbound/outbound rules with precedence — are a Connect Sync specialty.

Entra Cloud Sync (the newer, lighter engine)

Microsoft Entra Cloud Sync moves the sync logic into Microsoft's cloud. You install one or more lightweight Microsoft Entra provisioning agents on-prem; the agents read from AD over LDAP and relay changes to the cloud sync service, which writes to Entra ID. There is no on-prem metaverse to maintain.

Cloud Sync advantages:

• Multi-agent high availability — install up to four agents per domain; the cloud service load-balances across them and fails over automatically
• Large-environment scale — Microsoft documents Cloud Sync as better suited to large or scaled environments where a single Connect Sync server becomes a bottleneck
• Simpler upgrades — sync logic lives in the cloud, so Microsoft rolls out fixes without an on-prem server upgrade
• Lighter footprint — no SQL Express instance, no metaverse database, no sync-server OS to patch in the same way

Cloud Sync is Microsoft's recommended path for new deployments that do not need federation or the write-back features exclusive to Connect Sync.

Choosing Between the Two

The two engines cannot run full directory sync against the same tenant simultaneously — pick one per tenant and plan migration if you ever need to switch.

Sign-in Method Configuration

Both engines let you choose a sign-in method during install:

• Password Hash Sync (PHS) — hashes of on-prem passwords are synchronized to Entra ID; users sign in against Entra with the same password. Simplest, no on-prem dependency at sign-in time.
• Pass-Through Authentication (PTA) — an on-prem agent validates the password directly against AD at sign-in. No password hash leaves the perimeter. Requires PTA agents for availability.
• Federation (AD FS) — Connect Sync only. The STS issues tokens; Entra trusts it. Choose for smartcard/HAADJ, on-prem MFA, or claims-based apps.

Filtering

Filtering controls which on-prem objects reach the cloud. Both engines support:

• Domain-based filtering — include or exclude whole domains
• OU-based filtering — include or exclude specific OUs; the most common scoping method
• Group-based filtering — synchronize only members of a pilot group (useful for staged rollouts)

In Connect Sync, filtering is configured in the wizard and stored in sync rules. In Cloud Sync, filtering is configured as scoping filters on the provisioning configuration in the Entra admin center.

Attribute Mapping and Exchange Hybrid

Both engines map on-prem AD attributes to Entra ID attributes. Default mappings cover the common attributes (givenName, surname, displayName, mail, userPrincipalName, proxyAddresses). You can extend mapping for custom attributes — in Connect Sync via the sync rule editor, in Cloud Sync via the attribute-mapping UI.

For Exchange hybrid, Connect Sync writes back on-prem attributes such as msExchArchiveGUID and msExchSafeSendersHash so on-prem Exchange and Exchange Online coexist. Cloud Sync has limited exchange hybrid support — verify the specific write-back attributes you need before choosing.