Key takeaway: Entra Connect (formerly Azure AD Connect) and Entra Connect Cloud Sync are both Microsoft tools for synchronizing on-premises Active Directory to Entra ID, but they serve different architectures. Entra Connect is the full-featured on-premises agent with support for complex topologies, device writeback, and Exchange hybrid — it should be your default for most enterprise environments. Cloud Sync uses a lightweight cloud-provisioning agent and is purpose-built for multi-forest scenarios and organizations with simpler sync requirements. The right choice depends on your forest count, whether you need Exchange hybrid, and your device management strategy.
In This Article
- Why Do Organizations Use Hybrid Identity with Microsoft 365?
- What Is Entra Connect and When Should You Use It?
- What Is Entra Connect Cloud Sync and How Is It Different?
- How Do Entra Connect and Cloud Sync Compare Feature by Feature?
- How Do You Choose Between Entra Connect and Cloud Sync?
- How Do You Migrate from Entra Connect to Cloud Sync?
If your organization runs Active Directory on-premises and uses Microsoft 365 or Azure, you need a sync mechanism to keep identities consistent between the two. Microsoft provides two tools: Entra Connect (formerly Azure AD Connect) and Entra Connect Cloud Sync (formerly Azure AD Connect Cloud Sync). They accomplish the same fundamental goal — synchronizing users, groups, and optionally devices from on-premises AD to Entra ID — but they use different architectures, have different feature sets, and are suited for different environments. Here is how they compare as of 2025.
Why Do Organizations Use Hybrid Identity with Microsoft 365?
Hybrid identity lets a single user account serve both on-premises resources (file servers, legacy applications, on-prem Exchange) and cloud resources (Microsoft 365, Azure, SaaS apps). Without sync, you have two separate identity silos — a local AD account and a separate Entra ID account — and users need separate credentials for cloud services. Hybrid identity solves this by projecting on-premises AD objects into Entra ID, and optionally writing back certain attributes from the cloud to on-premises.
Authentication can then happen in one of three models: Password Hash Sync (PHS), where hashed passwords are synced to the cloud and authentication occurs in Entra ID; Pass-Through Authentication (PTA), where authentication requests are proxied back to on-premises AD; or federation with AD FS, where Entra ID delegates authentication entirely to an on-premises STS. PHS is the most resilient model and is Microsoft's current recommendation for most organizations.
What Is Entra Connect and When Should You Use It?
Entra Connect is a Windows Server application installed on a dedicated on-premises server (or VM). It connects directly to your AD domain controllers via LDAP and synchronizes identity data to Entra ID on a 30-minute cycle. Configuration is done locally on the sync server through a GUI wizard and PowerShell. Staging mode allows you to run a passive secondary server that stays in sync without writing to Entra ID — failover is manual but recovery is fast.
Entra Connect supports the full breadth of hybrid identity features:
- Password Hash Sync — syncs password hashes every 2 minutes; enables leaked credential detection in Entra ID Protection
- Pass-Through Authentication — authentication agents installed on-prem; supports on-premises password complexity policies
- Seamless SSO — Kerberos-based single sign-on for domain-joined devices on the corporate network
- Exchange Hybrid — required for hybrid coexistence between Exchange on-premises and Exchange Online; writes back mail-related attributes
- Device writeback — writes Entra-registered devices back to on-premises AD for conditional access policies against hybrid-joined devices
- Group writeback v2 — writes Microsoft 365 Groups and security groups back to on-prem AD
- Password writeback — enables self-service password reset (SSPR) to update on-premises passwords from the cloud
- Attribute-based scoping — include/exclude objects using AD attributes, OU structure, or domain filtering
- Multi-forest support — can sync from multiple AD forests into a single Entra ID tenant, with complex join rules
The primary operational burden is the sync server itself: it needs to be maintained, patched, backed up, and monitored. Entra Connect receives updates on a roughly quarterly cycle. Running an outdated version past 18 months typically results in the application stopping sync and displaying deprecation warnings.
What Is Entra Connect Cloud Sync and How Is It Different?
Cloud Sync replaces the heavyweight on-premises application with lightweight provisioning agents — small Windows services that run on any domain-joined Windows Server. The agents handle AD connectivity and pass encrypted data to the Microsoft Entra provisioning service, which runs in the cloud and performs all configuration, orchestration, and transformation logic. You configure sync entirely through the Entra ID portal or Microsoft Graph API — no on-premises GUI.
The agent footprint is intentionally minimal: agents can run on existing servers, do not require dedicated hardware, and multiple agents can be deployed for high availability. This makes Cloud Sync operationally simpler to maintain at the cost of feature completeness.
Cloud Sync's key advantages:
- Multi-forest from the cloud — connect agents to multiple disconnected forests without complex Entra Connect join rules
- No dedicated sync server — agents can share infrastructure with other workloads
- Cloud-managed configuration — all config in the Entra portal; no local sync engine state to back up
- Faster provisioning — near real-time sync for new user creation scenarios (seconds vs. up to 30 minutes)
- Granular scoping with attribute-based filters
Current feature gaps relative to Entra Connect (as of mid-2025):
- Exchange Hybrid writeback — not supported; cannot coexist with on-premises Exchange using Cloud Sync alone
- Device writeback — not supported
- Pass-Through Authentication — not supported (PHS only)
- AD FS integration — not applicable
Microsoft has been narrowing these gaps and has publicly committed to making Cloud Sync the primary sync mechanism going forward. Check the Microsoft roadmap for current feature parity status before making a decision.
How Do Entra Connect and Cloud Sync Compare Feature by Feature?
| Capability | Entra Connect | Cloud Sync |
|---|---|---|
| Architecture | On-prem Windows Server application | Lightweight cloud-managed agents |
| Password Hash Sync | ✓ | ✓ |
| Pass-Through Authentication | ✓ | ✗ |
| Seamless SSO | ✓ | ✓ |
| Password Writeback (SSPR) | ✓ | ✓ |
| Exchange Hybrid | ✓ | ✗ |
| Device Writeback | ✓ | ✗ |
| Group Writeback v2 | ✓ | ✓ |
| Multi-Forest | ✓ (complex config) | ✓ (simpler) |
| Sync Interval | 30 minutes | Near real-time |
| Configuration location | On-premises | Entra portal / Graph API |
| High availability | Staging server (manual failover) | Multiple agents (automatic) |
How Do You Choose Between Entra Connect and Cloud Sync?
Use Entra Connect if: you are running Exchange Server on-premises in hybrid coexistence, you require Pass-Through Authentication for on-premises password policy enforcement, you need device writeback for Conditional Access policies targeting hybrid Azure AD joined devices, or you have complex multi-forest topologies with custom attribute flow rules already built and tested.
Use Cloud Sync if: you are a net-new deployment without Exchange hybrid requirements, you want to sync from multiple disconnected forests without complex infrastructure, you prefer cloud-managed configuration and minimal on-prem footprint, or you are planning an eventual decommission of on-premises AD and want the lightest possible bridge.
Microsoft's current positioning (as of 2025) is that Cloud Sync is the preferred tool for new deployments where feature requirements allow it. For existing Entra Connect installations in production, there is no urgency to migrate — Entra Connect remains fully supported with no announced end-of-support date.
Important: You cannot run both Entra Connect and Cloud Sync synchronizing the same set of objects simultaneously. You can run them in parallel for different OUs or forests, but overlapping scope causes conflicts. Plan your scope carefully before deploying both.
How Do You Migrate from Entra Connect to Cloud Sync?
If you are moving from Entra Connect to Cloud Sync, Microsoft's recommended approach is a soft cutover: install Cloud Sync agents and configure them to sync the same scope as Entra Connect, then verify sync is working in Cloud Sync mode before decommissioning the Entra Connect server. The critical step is disabling Entra Connect's scheduled sync (Set-ADSyncScheduler -SyncCycleEnabled $false) before enabling Cloud Sync writes, to avoid conflicts. Once Cloud Sync is confirmed healthy, uninstall Entra Connect and remove the service account. Account objects synchronized by either tool remain in Entra ID — switching tools does not reprovision objects.
The reverse migration — from Cloud Sync to Entra Connect — follows the same pattern. Deploy Entra Connect in staging mode first, verify sync results match, then perform the cutover by disabling Cloud Sync and enabling Entra Connect's scheduler. Always test in a lab environment with a subset of your AD objects before migrating production identity infrastructure.