Two paths to the same synchronization objective
Every hybrid organization must answer the same question: how can an on-premises Active Directory coexist with Microsoft Entra ID? Microsoft offers two technical answers to this need: Microsoft Entra Connect Sync (formerly Azure AD Connect) and Microsoft Entra Cloud Sync. Both provision identities to the cloud, but their architecture, operational overhead, and functional scope differ significantly.
This choice is not trivial: it determines your infrastructure topology, your ability to manage multiple AD forests, and your compatibility with hybrid Exchange scenarios. Here are the concrete criteria to make your decision.
Good to know about licensing
Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync are both included for free, regardless of the Microsoft Entra ID edition (including the Free edition). There is no additional cost associated with choosing one tool over the other.
Microsoft Entra Connect Sync: the historic and complete solution
Microsoft Entra Connect Sync (the current name for Azure AD Connect) remains the functionally richest solution. It is installed on a dedicated on-premises Windows Server and acts as a complete synchronization engine between the local directory and Microsoft Entra ID.
Its distinctive strengths:
- Granular filtering by organizational unit (OU) to synchronize only a specific scope of objects.
- Attribute writeback to on-premises AD (device writeback, group writeback, password writeback).
- Full support for hybrid Exchange scenarios, including writeback of Exchange attributes necessary for proper functioning of the shared Global Address List (GAL).
- Support for complex multi-forest topologies with custom synchronization rules.
This richness comes with a real operational cost: maintenance of the dedicated server, regular application of version updates (obsolete builds eventually get blocked by the service), supervision via event logs and the integrated diagnostic tool, and management of additional infrastructure to secure (server hardening, service accounts, network exposure to Microsoft Entra ID).
Known pitfall
A Microsoft Entra Connect Sync server that hasn't been updated in several major versions may have its synchronization interrupted by Microsoft, which enforces a deprecation policy for older versions. Check the version in place via the Microsoft Entra portal (Identity > Hybrid Management > Microsoft Entra Connect) before any audit.
Microsoft Entra Cloud Sync: the lightweight agent controlled from the cloud
Microsoft Entra Cloud Sync reverses the architectural logic. Instead of a complete synchronization server, it relies on one or more lightweight provisioning agents (Cloud Sync Provisioning Agent) installed on-premises, while all configuration — mapping rules, filtering, scheduling — is controlled entirely from the Microsoft Entra portal.
Concrete benefits:
- Simplified deployment: the agent is installed in minutes, without requiring a dedicated synchronization server.
- Native high availability: multiple agents can be deployed in parallel to ensure redundancy, without cluster configuration.
- Automatic updates of the agent, managed by Microsoft, reducing version drift.
- Native support for multi-forest without complex topology, a notable advantage in merger-acquisition or consolidation contexts with multiple AD domains.
The trade-off: Cloud Sync does not (yet) cover the full range of advanced scenarios supported by Microsoft Entra Connect Sync, notably certain writebacks specific to the most complex hybrid Exchange deployments.
Recommended verification
Before switching to Cloud Sync, consult the official documentation on Microsoft Entra Cloud Sync limitations to confirm that your hybrid Exchange scenario or custom synchronization rules are well supported.
Synthetic comparison of the two approaches
| Criterion | Microsoft Entra Connect Sync | Microsoft Entra Cloud Sync |
|---|---|---|
| On-premises component | Complete dedicated server | Lightweight provisioning agent |
| Control | Local wizard + PowerShell | Microsoft Entra portal |
| OU filtering | Yes, granular | Yes, but less fine-grained in some cases |
| Advanced hybrid Exchange writeback | Yes, complete | Partial support depending on scenario |
| Complex multi-forests | Yes, with custom rules | Yes, with simplified configuration |
| High availability | To build (cluster, staging server) | Native via redundant agents |
| Maintenance overhead | High (patches, versions, monitoring) | Low (automatic updates) |
| License cost | Included with Microsoft Entra ID | Included with Microsoft Entra ID |
Which tool to choose based on your scenario
The choice is made case by case, depending on the real complexity of your environment:
- Opt for Microsoft Entra Connect Sync if you manage an advanced hybrid Exchange deployment, if you need sophisticated custom synchronization rules, or if your multi-forest AD topology requires fine-grained control not covered by Cloud Sync.
- Opt for Microsoft Entra Cloud Sync if you aim for a cloud-first approach, if you want to reduce the on-premises footprint, or if your need is limited to standard identity synchronization without complex writeback.
- Consider coexistence: some organizations run both tools in parallel, each covering a different subset of objects or forests. Microsoft documents this scenario as supported, provided objects are well scoped to avoid synchronization conflicts.
Migrating from Microsoft Entra Connect Sync to Cloud Sync
If you are considering a switch, proceed in stages rather than a brutal cold migration:
Audit the features in use
List the active features on your Microsoft Entra Connect Sync server: OU filtering, group writeback, password writeback, custom rules. Confirm their equivalent in Cloud Sync before any decision.
Deploy the Cloud Sync agent in parallel
Install the Cloud Sync Provisioning Agent on a separate server without disabling the existing synchronization. Configure a test scope limited to a few non-critical OUs.
Validate synchronization in a pilot environment
Verify in the Microsoft Entra portal that test objects synchronize correctly, that expected attributes are present, and that hybrid Exchange scenarios (if applicable) continue to work.
Progressively switch the complete scope
Extend the Cloud Sync scope in waves, then definitively disable Microsoft Entra Connect Sync once the entire scope is validated in production.
In summary
- Microsoft Entra Connect Sync (Azure AD Connect) remains the reference for complex scenarios: advanced hybrid Exchange, rich writeback, multi-forests with custom rules.
- Microsoft Entra Cloud Sync suits cloud-first organizations that want to reduce on-premises maintenance and benefit from native high availability.
- Both solutions are included at no additional cost with any edition of Microsoft Entra ID.
- Coexistence of both tools is possible and sometimes relevant, provided the synchronized scopes are well delimited.
- Before any migration, precisely audit the features in place to avoid loss of functional capacity after switching.
The right choice is not the most technically recent: it's the one that fits your actual AD topology, your hybrid Exchange constraints, and your operational capacity to maintain (or not) a dedicated server.
