Microsoft Entra Cloud Sync - Simply Explained

1
00:00:00,000 --> 00:00:04,880
Hello everyone and welcome to another episode of Microsoft Knowledge Nuggets here on M365.

2
00:00:04,880 --> 00:00:07,960
FM, Eau, TMNM, Mirko Peters.

3
00:00:07,960 --> 00:00:10,240
What exactly is Microsoft Entra Cloud Sync?

4
00:00:10,240 --> 00:00:14,160
Is it just another name for Entra Connect or does it solve a different problem?

5
00:00:14,160 --> 00:00:18,400
Many companies still keep employee accounts in Active Directory inside their own network.

6
00:00:18,400 --> 00:00:20,960
Yet employees work in Microsoft 365.

7
00:00:20,960 --> 00:00:25,240
They need Teams, Exchange Online Email, OneDrive Files and Cloud Apps.

8
00:00:25,240 --> 00:00:27,640
That creates two places where identity matters.

9
00:00:27,640 --> 00:00:31,640
Without a link between them, someone might exist in Active Directory but not in Entra ID,

10
00:00:31,640 --> 00:00:34,400
the Cloud Reception Desk for Microsoft 365.

11
00:00:34,400 --> 00:00:36,440
passwords don't automatically match.

12
00:00:36,440 --> 00:00:37,880
Access arrives late.

13
00:00:37,880 --> 00:00:41,200
IT ends up doing the same work twice.

14
00:00:41,200 --> 00:00:44,640
Entra Connect became the familiar local tool for linking those two places.

15
00:00:44,640 --> 00:00:46,480
Cloud Sync takes a different path.

16
00:00:46,480 --> 00:00:49,160
With more of the sync work handled in Microsoft Entra.

17
00:00:49,160 --> 00:00:53,320
By the end, you would know what it does, why it exists and what changed in 2026.

18
00:00:53,320 --> 00:00:57,320
But one boundary still decides whether it fits your company.

19
00:00:57,320 --> 00:01:00,640
My identity sync needs a simpler model.

20
00:01:00,640 --> 00:01:04,240
Start with a new employee, HR tells IT that Maya starts on Monday.

21
00:01:04,240 --> 00:01:08,360
Someone creates my out-temiz account in Active Directory, which many companies still use as

22
00:01:08,360 --> 00:01:10,160
the local start filing cabinet.

23
00:01:10,160 --> 00:01:15,360
Her name, work email, department, manager, group membership and password details all begin

24
00:01:15,360 --> 00:01:16,360
there.

25
00:01:16,360 --> 00:01:19,320
But Maya does not make work only inside the company network.

26
00:01:19,320 --> 00:01:21,040
She needs to sign into Teams from home.

27
00:01:21,040 --> 00:01:23,160
She needs her Exchange Online mailbox.

28
00:01:23,160 --> 00:01:27,920
Her team stores files in SharePoint and she may need access to payroll, CRM, training or

29
00:01:27,920 --> 00:01:30,120
other cloud apps before her first day ends.

30
00:01:30,120 --> 00:01:32,280
One person needs one working identity.

31
00:01:32,280 --> 00:01:36,160
That identity needs to appear in both places while still referring to the same Maya.

32
00:01:36,160 --> 00:01:37,520
Her sign-in name needs to match.

33
00:01:37,520 --> 00:01:39,760
Her group information needs to reach the cloud.

34
00:01:39,760 --> 00:01:44,840
When her password changes in Active Directory, Microsoft 365 needs a safe way to confirm

35
00:01:44,840 --> 00:01:46,160
that password too.

36
00:01:46,160 --> 00:01:48,400
That opens the job of Identity Sync.

37
00:01:48,400 --> 00:01:52,800
Think of Active Directory as the filing cabinet in the basement of an office building.

38
00:01:52,800 --> 00:01:55,680
It holds the staff records the company already trusts.

39
00:01:55,680 --> 00:01:59,640
Entra ID sits at reception upstairs, deciding who can enter Microsoft 365 and which rooms

40
00:01:59,640 --> 00:02:00,640
they can use.

41
00:02:00,640 --> 00:02:05,520
If the filing cabinet and reception desk, Donau, Temt, Share information, Maya gets stopped

42
00:02:05,520 --> 00:02:06,520
at the door.

43
00:02:06,520 --> 00:02:11,360
20 years ago, that gap caused a lot of manual work, an IT team might create one account locally,

44
00:02:11,360 --> 00:02:13,640
then create another account in a cloud service.

45
00:02:13,640 --> 00:02:17,960
When Maya changed her name, changed Teams, or left the company, somebody needed to remember

46
00:02:17,960 --> 00:02:20,400
every place where her details lived.

47
00:02:20,400 --> 00:02:21,720
People forget.

48
00:02:21,720 --> 00:02:25,040
That u-tems-wise, thinking identity changed daily IT work.

49
00:02:25,040 --> 00:02:28,560
A change in Active Directory could flow into Entra ID, so the cloud account followed the

50
00:02:28,560 --> 00:02:32,200
local account instead of becoming a second separate record.

51
00:02:32,200 --> 00:02:34,640
For a long time, Entra Connect handles that work.

52
00:02:34,640 --> 00:02:37,240
Entra Connect runs on a server inside the company network.

53
00:02:37,240 --> 00:02:42,160
It reads Active Directory, applies local sync rules, keeps its own local data store, and sends

54
00:02:42,160 --> 00:02:44,160
approved changes to Entra ID.

55
00:02:44,160 --> 00:02:48,200
It can do a lot, especially when a company needs deep control over how data moves.

56
00:02:48,200 --> 00:02:50,280
That flexibility comes with responsibility.

57
00:02:50,280 --> 00:02:53,440
Someone needs to look after the server, someone needs to patch it.

58
00:02:53,440 --> 00:02:57,440
Someone needs to understand the local rules if a user does notemptet sync as expected.

59
00:02:57,440 --> 00:03:01,320
And if the main sync server stops working, changes can stop reaching Microsoft 365 until

60
00:03:01,320 --> 00:03:03,800
IT fixes the issue, or follows a recovery plan.

61
00:03:03,800 --> 00:03:06,040
For Maya, that might mean her account waits.

62
00:03:06,040 --> 00:03:09,920
For a company with hundreds or thousands of people, it can mean new starters, Dona Will

63
00:03:09,920 --> 00:03:14,840
Demd, appear in cloud apps, disabled accounts take longer to lose access, and support calls

64
00:03:14,840 --> 00:03:16,600
start piling up.

65
00:03:16,600 --> 00:03:19,320
The problem is now that Entra Connect failed as a product.

66
00:03:19,320 --> 00:03:22,560
It outtoms that every local engine brings local work with it.

67
00:03:22,560 --> 00:03:25,440
Many companies want fewer moving parts on their own servers.

68
00:03:25,440 --> 00:03:26,720
Cloud Sync follows that idea.

69
00:03:26,720 --> 00:03:30,840
Instead of placing the large sync engine, detailed processing, and most of the rules inside

70
00:03:30,840 --> 00:03:34,480
your network, Microsoft Entra handles much of that work in the cloud.

71
00:03:34,480 --> 00:03:38,200
Your local network keeps a smaller connection point that can read Active Directory and safely

72
00:03:38,200 --> 00:03:39,480
communicate outward.

73
00:03:39,480 --> 00:03:41,200
The filing cabinet stays where it is.

74
00:03:41,200 --> 00:03:44,960
The processing moves closer to the reception desk that can reduce the amount of local software

75
00:03:44,960 --> 00:03:49,080
your team needs to manage, while keeping Active Directory as the place where employee details

76
00:03:49,080 --> 00:03:50,080
begin.

77
00:03:50,080 --> 00:03:53,040
It also changes how you think about recovery, especially when a company has more than one

78
00:03:53,040 --> 00:03:56,640
office, more than one directory, or a recent merger to deal with.

79
00:03:56,640 --> 00:04:01,920
So if the main sync work runs in the cloud, what exactly stays inside your company network?

80
00:04:01,920 --> 00:04:05,640
But what Microsoft Entra Cloud Sync actually is?

81
00:04:05,640 --> 00:04:10,400
Microsoft Entra Cloud Sync is a cloud-managed way to copy selected people, groups, and contacts

82
00:04:10,400 --> 00:04:13,240
from Active Directory into Entra ID.

83
00:04:13,240 --> 00:04:15,040
Think of it as a secure career service.

84
00:04:15,040 --> 00:04:18,360
Your Active Directory holds the staff records inside your network.

85
00:04:18,360 --> 00:04:22,000
Active Directory ID needs the approved parts of those records so people can sign into Microsoft

86
00:04:22,000 --> 00:04:23,000
365.

87
00:04:23,000 --> 00:04:28,000
Cloud Sync puts a small career called the provisioning agent inside your network to carry that information

88
00:04:28,000 --> 00:04:29,400
safely between the two.

89
00:04:29,400 --> 00:04:31,880
The career does now and it holds a second filing system.

90
00:04:31,880 --> 00:04:36,200
It reads the directory information you approve, encrypts it, and sends it through an outbound

91
00:04:36,200 --> 00:04:38,080
connection to Microsoft Entra.

92
00:04:38,080 --> 00:04:41,680
An outbound connection means the agent starts the conversation with the cloud.

93
00:04:41,680 --> 00:04:45,680
You don't need to open your network and wait for an unknown connection to come in.

94
00:04:45,680 --> 00:04:47,600
That UTIMS are useful security detail.

95
00:04:47,600 --> 00:04:51,080
The agent can reach Active Directory because it sits inside your network.

96
00:04:51,080 --> 00:04:55,000
Microsoft Entra can process the data because the agent sends it securely to the cloud.

97
00:04:55,000 --> 00:04:59,960
The two sides can work together without placing the full sync engine on your own server.

98
00:04:59,960 --> 00:05:02,880
Behind the scenes, Entra handles the larger part of the job.

99
00:05:02,880 --> 00:05:05,560
It checks whether a person already exists in Entra ID.

100
00:05:05,560 --> 00:05:07,480
It applies your chosen scope.

101
00:05:07,480 --> 00:05:09,520
It follows the field mappings you set.

102
00:05:09,520 --> 00:05:13,880
Then it creates or updates the cloud object when the information matches your rules.

103
00:05:13,880 --> 00:05:15,800
You manage those choices in the Entra portal.

104
00:05:15,800 --> 00:05:18,000
This is a big change if you know Entra Connect.

105
00:05:18,000 --> 00:05:21,920
With Entra Connect, much of the logic and troubleshooting work happens on the server that

106
00:05:21,920 --> 00:05:23,320
runs the sync tool.

107
00:05:23,320 --> 00:05:27,600
With Cloud Sync, you create a configuration in the portal, choose what should sync, map

108
00:05:27,600 --> 00:05:30,600
the fields, and check the results in one cloud location.

109
00:05:30,600 --> 00:05:32,400
The local agent stays small.

110
00:05:32,400 --> 00:05:37,120
There opens no large local sync engine with a local SQL database for Cloud Sync.

111
00:05:37,120 --> 00:05:43,280
You are now TM, T, opening a local rule editor every time you need to check a basic mapping.

112
00:05:43,280 --> 00:05:47,400
Microsoft handles updates to the agent while your team focuses on the identity rules that

113
00:05:47,400 --> 00:05:48,720
matter to the business.

114
00:05:48,720 --> 00:05:50,720
That does not invite team in you lose control.

115
00:05:50,720 --> 00:05:53,640
You still choose the people and groups that can enter Entra ID.

116
00:05:53,640 --> 00:05:58,680
You can choose fields such as display name, department, phone number, or manager.

117
00:05:58,680 --> 00:06:00,640
A mapping simply answers a plain question.

118
00:06:00,640 --> 00:06:04,640
Rich label on the Active Directory record should fill which label in Entra ID.

119
00:06:04,640 --> 00:06:07,840
For many companies, the default mappings cover normal staff accounts.

120
00:06:07,840 --> 00:06:12,360
If your Active Directory display name says Maya Patel, Entra ID can receive Maya Patel.

121
00:06:12,360 --> 00:06:16,240
If her department changes from sales to customer success, that update can reach her cloud

122
00:06:16,240 --> 00:06:17,240
account.

123
00:06:17,240 --> 00:06:21,360
If her group membership gives her access to a Microsoft 365 resource, the group information

124
00:06:21,360 --> 00:06:22,360
can sync to.

125
00:06:22,360 --> 00:06:24,080
Some setups need small changes.

126
00:06:24,080 --> 00:06:27,360
Cloud Sync includes simple expressions for cases where you need to adjust a value as it

127
00:06:27,360 --> 00:06:28,360
moves.

128
00:06:28,360 --> 00:06:32,400
Maybe a company wants a suffix added to a display name for a certain set of accounts.

129
00:06:32,400 --> 00:06:36,400
You can set that in the cloud configuration rather than building a deep set of local

130
00:06:36,400 --> 00:06:37,400
sync rules.

131
00:06:37,400 --> 00:06:38,400
Keep that distinction in mind.

132
00:06:38,400 --> 00:06:41,680
Cloud Sync gives you sensible control for common identity work.

133
00:06:41,680 --> 00:06:46,160
It is now demand designed to copy every advanced customization that a long running Entra

134
00:06:46,160 --> 00:06:47,680
Connect setup may contain.

135
00:06:47,680 --> 00:06:51,640
We will come back to that decision later because it can save you from choosing the tool

136
00:06:51,640 --> 00:06:54,600
just because I do TMones newer.

137
00:06:54,600 --> 00:06:56,200
Passwords cause the most questions.

138
00:06:56,200 --> 00:06:58,760
Cloud Sync can use password hash synchronization.

139
00:06:58,760 --> 00:07:00,920
That phrase sounds more alarming than it is.

140
00:07:00,920 --> 00:07:04,880
The readable password does now TMRT get sent to Microsoft Entra.

141
00:07:04,880 --> 00:07:09,400
Instead Active Directory creates protected password verification information and Entra ID

142
00:07:09,400 --> 00:07:12,960
uses that information to check a person's mouse to TMRT sign in safely.

143
00:07:12,960 --> 00:07:16,400
So Maya can use her company password for Microsoft 365.

144
00:07:16,400 --> 00:07:18,680
Her password still begins in Active Directory.

145
00:07:18,680 --> 00:07:23,480
When she changes it there, the updated verification information syncs to Entra ID.

146
00:07:23,480 --> 00:07:28,520
Microsoft 365 can then confirm her sign in without storing a readable copy of the password.

147
00:07:28,520 --> 00:07:30,960
One ownership rule keeps everything clear.

148
00:07:30,960 --> 00:07:34,880
When a user syncs from Active Directory, Active Directory remains the place where you added

149
00:07:34,880 --> 00:07:35,880
the syncs details.

150
00:07:35,880 --> 00:07:40,240
If MayaoTemps department or drop title needs to change, you change it in Active Directory,

151
00:07:40,240 --> 00:07:42,960
then Cloud Sync carries that change to Entra ID.

152
00:07:42,960 --> 00:07:45,680
You will often see those Cloud fields locked for editing.

153
00:07:45,680 --> 00:07:47,320
That is no-term it a problem.

154
00:07:47,320 --> 00:07:49,360
It tells you where the account comes from.

155
00:07:49,360 --> 00:07:53,080
You can change that ownership later through a planned source of authority change, but Cloud

156
00:07:53,080 --> 00:07:56,680
Sync does now attempt silently turn local accounts into Cloud Managed accounts.

157
00:07:56,680 --> 00:08:00,720
The agent explains why Cloud Sync feels lighter, but the next part explains why it can also

158
00:08:00,720 --> 00:08:03,680
keep working when one server drops offline.

159
00:08:03,680 --> 00:08:06,120
How Cloud Sync keeps working when a server fails?

160
00:08:06,120 --> 00:08:09,000
A Sync tool only helps while it can reach Active Directory.

161
00:08:09,000 --> 00:08:13,440
Picture a Monday morning when a server needs an urgent restart, or it's disk fails without

162
00:08:13,440 --> 00:08:14,440
warning.

163
00:08:14,440 --> 00:08:18,080
A manager creates a new starter in Active Directory, but that person does not empty appear

164
00:08:18,080 --> 00:08:19,960
in Microsoft 365.

165
00:08:19,960 --> 00:08:24,040
Someone disables an employee who has left, but the Cloud account waits for the change.

166
00:08:24,040 --> 00:08:26,200
Those delays create real work for IT.

167
00:08:26,200 --> 00:08:30,520
With a traditional Entra Connect setup, companies often run one Active Sync server and keep

168
00:08:30,520 --> 00:08:33,240
another server in staging mode as a backup.

169
00:08:33,240 --> 00:08:37,360
That backup needs planning, testing, and a clear process for taking over when the Active

170
00:08:37,360 --> 00:08:38,680
server fails.

171
00:08:38,680 --> 00:08:40,000
Cloud Sync takes a different route.

172
00:08:40,000 --> 00:08:43,960
You can install more than one provisioning agent in the same Active Directory domain.

173
00:08:43,960 --> 00:08:47,720
Each agent connects to the same Cloud Sync configuration in Microsoft Entra, and each one

174
00:08:47,720 --> 00:08:49,680
can read the same directory information.

175
00:08:49,680 --> 00:08:50,680
You don't know TNT.

176
00:08:50,680 --> 00:08:53,640
You need to treat one agent like the permanent boss.

177
00:08:53,640 --> 00:08:55,720
Microsoft Entra watches the available agents.

178
00:08:55,720 --> 00:09:00,040
If one agent goes offline, the Cloud service can use another healthy agent to continue

179
00:09:00,040 --> 00:09:01,040
the work.

180
00:09:01,040 --> 00:09:05,800
That is built in high availability, which simply means you avoid having one server become

181
00:09:05,800 --> 00:09:07,360
a single point of failure.

182
00:09:07,360 --> 00:09:10,480
Think of two help desks using the same staff directory.

183
00:09:10,480 --> 00:09:14,280
If one desk closes for the day, the other desk can still take calls and check people in.

184
00:09:14,280 --> 00:09:18,240
The people in the company don't know TNT need to know which desk handled their request.

185
00:09:18,240 --> 00:09:19,920
They just need their access to work.

186
00:09:19,920 --> 00:09:21,880
That utems the practical benefit.

187
00:09:21,880 --> 00:09:26,160
Instead of building a manual failover plan around a large local Sync engine, you install

188
00:09:26,160 --> 00:09:30,080
more than one lightweight agent and let Entra use the agents that are online.

189
00:09:30,080 --> 00:09:33,760
You should still monitor agent health, keep the server supported and test your recovery

190
00:09:33,760 --> 00:09:34,760
plan.

191
00:09:34,760 --> 00:09:38,360
Built in failover does not timet, remove the need for responsible IT.

192
00:09:38,360 --> 00:09:41,120
It does remove some of the pressure from one machine.

193
00:09:41,120 --> 00:09:44,360
Cloud Sync also helps when a company has separate Active Directory forests.

194
00:09:44,360 --> 00:09:47,120
A forest is a separate Active Directory environment.

195
00:09:47,120 --> 00:09:50,040
You might have one because your company bought another business.

196
00:09:50,040 --> 00:09:54,300
The two companies may use different domains, different networks, and separate local

197
00:09:54,300 --> 00:09:57,940
directories that can now TNT directly talk to each other.

198
00:09:57,940 --> 00:09:59,860
That outtems common after a merger.

199
00:09:59,860 --> 00:10:02,860
With Cloud Sync, you can install an agent near each forest.

200
00:10:02,860 --> 00:10:07,020
Each agent reads its own local Active Directory, then connects outward to the same Microsoft

201
00:10:07,020 --> 00:10:08,020
Entra tenant.

202
00:10:08,020 --> 00:10:12,580
The cloud becomes the shared destination, even when the local directories remain apart.

203
00:10:12,580 --> 00:10:15,940
No direct network pass between the forest is required for that setup.

204
00:10:15,940 --> 00:10:19,060
Imagine a company in London acquires a business in Toronto.

205
00:10:19,060 --> 00:10:23,080
Both teams need to use the same Microsoft 365 tenant, but connecting their old directory

206
00:10:23,080 --> 00:10:25,480
networks would take months and raise security questions.

207
00:10:25,480 --> 00:10:30,280
An agent in London can sync London accounts while an agent in Toronto syncs Toronto accounts.

208
00:10:30,280 --> 00:10:34,160
Both sets of users can arrive in the same Entra ID that can give a time to plan the larger

209
00:10:34,160 --> 00:10:38,360
directory work without blocking people from accessing teams, email and cloud apps.

210
00:10:38,360 --> 00:10:40,080
There are still practical requirements.

211
00:10:40,080 --> 00:10:43,520
Each agent needs a reliable connection to its local Active Directory.

212
00:10:43,520 --> 00:10:48,720
It also needs outbound access through your firewall or proxy to Microsoft UTMS cloud services.

213
00:10:48,720 --> 00:10:52,160
You don't know if T plays the agent on a random computer in hope for the best.

214
00:10:52,160 --> 00:10:56,240
Put it on supported servers, give it the right local access and install more than one agent

215
00:10:56,240 --> 00:10:57,920
for a production setup.

216
00:10:57,920 --> 00:10:59,920
Availability keeps the connection alive.

217
00:10:59,920 --> 00:11:04,320
But deciding which accounts should travel across that connection matters just as much.

218
00:11:04,320 --> 00:11:07,480
What gets synced and how you stay in control?

219
00:11:07,480 --> 00:11:11,680
Before cloud sync starts moving accounts into Entra ID, decide exactly who belongs in the

220
00:11:11,680 --> 00:11:12,880
syncs scope.

221
00:11:12,880 --> 00:11:16,280
Scope means the part of Active Directory cloud sync is allowed to read and copy.

222
00:11:16,280 --> 00:11:20,240
You can choose all supported objects in a domain that may suit a small company with one

223
00:11:20,240 --> 00:11:23,680
clean directory and one clear set of employee accounts.

224
00:11:23,680 --> 00:11:28,560
Large companies usually need more care because Active Directory can contain all test users,

225
00:11:28,560 --> 00:11:33,680
service accounts, training accounts and groups that nobody expects to see in Microsoft 365.

226
00:11:33,680 --> 00:11:38,160
A narrow starter void surprises cloud sync lets you limit the scope by organizational unit,

227
00:11:38,160 --> 00:11:41,000
often called an OU or by security group.

228
00:11:41,000 --> 00:11:44,280
An OU is like a labeled folder inside Active Directory.

229
00:11:44,280 --> 00:11:49,920
You might have one called O employees, O another called AU contractors, O and another called

230
00:11:49,920 --> 00:11:52,320
AU IT test accounts.

231
00:11:52,320 --> 00:11:58,520
A O. If only the employees OU should reach Microsoft 365, you can select that OU.

232
00:11:58,520 --> 00:12:00,480
Group-based scope gives you another option.

233
00:12:00,480 --> 00:12:04,080
Instead of selecting a whole folder, you choose a security group and add only the people you

234
00:12:04,080 --> 00:12:05,080
want to test.

235
00:12:05,080 --> 00:12:08,960
This works well when you want a small pilot without moving accounts around your directory.

236
00:12:08,960 --> 00:12:09,960
Start with a test group.

237
00:12:09,960 --> 00:12:12,880
Pick a few known users who can safely appear in Entra ID.

238
00:12:12,880 --> 00:12:16,400
Check their sign-in names, department details and group memberships.

239
00:12:16,400 --> 00:12:19,880
Confirm that the right accounts appear, then expand the scope when you trust the result.

240
00:12:19,880 --> 00:12:22,400
That small check can save a very long cleanup job.

241
00:12:22,400 --> 00:12:25,720
After you decide who can sync you decide which details travel with them.

242
00:12:25,720 --> 00:12:28,480
This is called attribute mapping, but it means something simple.

243
00:12:28,480 --> 00:12:33,080
Which field on an Active Directory account fills which field on the Entra ID account?

244
00:12:33,080 --> 00:12:37,920
A user record may include a first name, last name, display name, phone number, office, manager

245
00:12:37,920 --> 00:12:39,320
and department.

246
00:12:39,320 --> 00:12:41,960
Cloud sync includes default mappings for common setups.

247
00:12:41,960 --> 00:12:44,680
In many cases you should leave those defaults alone at first.

248
00:12:44,680 --> 00:12:48,440
They cover the normal fields most companies need and they make it easier to understand what

249
00:12:48,440 --> 00:12:50,600
changed if a result looks wrong.

250
00:12:50,600 --> 00:12:53,760
You can adjust a mapping when their O-tems are clear business reason.

251
00:12:53,760 --> 00:12:57,880
For example, a company might store a phone number in a local field that does know,

252
00:12:57,880 --> 00:12:59,800
"Tem match the Entra field it wants to fill."

253
00:12:59,800 --> 00:13:01,360
Cloud sync can map that field.

254
00:13:01,360 --> 00:13:05,520
It also supports simple expressions for small changes to a value without building a large

255
00:13:05,520 --> 00:13:06,720
set of local rules.

256
00:13:06,720 --> 00:13:09,360
But don't automate turn a clean setup into a puzzle.

257
00:13:09,360 --> 00:13:13,440
If your identity process depends on deep, unusual logic, write down that requirement

258
00:13:13,440 --> 00:13:14,960
before changing mappings.

259
00:13:14,960 --> 00:13:18,760
For normal accounts, clear defaults beat clever rules that nobody understands six months

260
00:13:18,760 --> 00:13:20,080
later.

261
00:13:20,080 --> 00:13:22,920
Cloud sync gives you a safe way to test before you enable a broad sync.

262
00:13:22,920 --> 00:13:25,320
It out to mappings called provision on demand.

263
00:13:25,320 --> 00:13:28,800
You choose one user and ask Cloud sync, "Oh, what would you do with this account?"

264
00:13:28,800 --> 00:13:33,040
A, A, O, the result shows whether the agent found the user, whether the user falls inside

265
00:13:33,040 --> 00:13:37,560
your scope, whether Entra ID found a matching account, and whether Cloud sync would create

266
00:13:37,560 --> 00:13:38,640
or update it.

267
00:13:38,640 --> 00:13:41,440
You can see the decision before it affects everyone else.

268
00:13:41,440 --> 00:13:44,520
Imagine an IT team builds a pilot group called O Cloud sync test.

269
00:13:44,520 --> 00:13:48,600
A, O, someone accidentally adds a larger group inside it, and that larger group contains

270
00:13:48,600 --> 00:13:50,320
hundreds of employees.

271
00:13:50,320 --> 00:13:54,440
Provision on demand exposes the scope problem while the team tests one person, rather than

272
00:13:54,440 --> 00:13:58,040
after hundreds of accounts appear in the tenant, that o-tim is the sort of mistake you

273
00:13:58,040 --> 00:13:59,720
want to find early.

274
00:13:59,720 --> 00:14:02,880
Cloud sync also includes accidental deletion protection.

275
00:14:02,880 --> 00:14:06,520
If a configuration suddenly tries to remove a large number of users or groups, the service

276
00:14:06,520 --> 00:14:10,440
can stop the run and place the configuration into quarantine instead of copying that damage

277
00:14:10,440 --> 00:14:12,240
straight into Entra ID.

278
00:14:12,240 --> 00:14:14,040
Humans receive an alert and can investigate.

279
00:14:14,040 --> 00:14:16,760
The Entra portal also gives you provisioning logs.

280
00:14:16,760 --> 00:14:19,080
Search for a user and you can see what happened.

281
00:14:19,080 --> 00:14:23,080
Whether the object matched, whether a field caused an error, whether the agent connected,

282
00:14:23,080 --> 00:14:28,160
and whether the configuration remains healthy, when identity sync works well, it feels quiet.

283
00:14:28,160 --> 00:14:31,480
When something goes wrong, those logs tell you where to look instead of leaving you to

284
00:14:31,480 --> 00:14:32,880
guess.

285
00:14:32,880 --> 00:14:36,600
Cloud sync now covers a wider range of needs, but it still does not meant replace every

286
00:14:36,600 --> 00:14:38,320
Entra Connect setup.

287
00:14:38,320 --> 00:14:42,160
Cloud sync versus Entra Connect and the 2026 shift.

288
00:14:42,160 --> 00:14:45,000
So should every company move from Entra Connect to Cloud sync?

289
00:14:45,000 --> 00:14:49,040
No, Cloud sync is newer but newer does not automatically mean it fits your setup.

290
00:14:49,040 --> 00:14:53,760
The right choice depends on what your identity system needs to do today, not on which product

291
00:14:53,760 --> 00:14:55,320
sounds more modern.

292
00:14:55,320 --> 00:14:59,720
Cloud sync suits companies that want a simpler local setup and cloud managed sync settings.

293
00:14:59,720 --> 00:15:03,160
It works well when you mainly need users, groups and contacts from Active Directory to

294
00:15:03,160 --> 00:15:04,160
appear in Entra ID.

295
00:15:04,160 --> 00:15:08,120
It also fits companies with separate forests, where each location can connect to the same

296
00:15:08,120 --> 00:15:11,400
Entra tenant without first joining all those local networks together.

297
00:15:11,400 --> 00:15:13,440
It gives you group-based scoping too.

298
00:15:13,440 --> 00:15:17,520
That can be helpful when you want to bring in one business unit, one new office or a small

299
00:15:17,520 --> 00:15:19,000
set of users first.

300
00:15:19,000 --> 00:15:22,800
You can keep the sync settings in the Entra portal, monitor the agents there, and avoid

301
00:15:22,800 --> 00:15:25,880
running a larger sync engine on one central server.

302
00:15:25,880 --> 00:15:27,480
Entra Connect still has a place.

303
00:15:27,480 --> 00:15:30,840
Some companies rely on sign-in methods that Cloud sync does now attempt support in the

304
00:15:30,840 --> 00:15:34,120
same way, such as pass through authentication or federation.

305
00:15:34,120 --> 00:15:37,400
Pass through authentication checks a password against Active Directory at the moment a user

306
00:15:37,400 --> 00:15:38,400
signs in.

307
00:15:38,400 --> 00:15:42,800
federation sends the sign-in request to another identity system, often one the company already

308
00:15:42,800 --> 00:15:45,520
uses, those setups need careful planning.

309
00:15:45,520 --> 00:15:48,880
Entra Connect can also suit companies with advanced local sync rules.

310
00:15:48,880 --> 00:15:53,520
Maybe they combine data from unusual fields, apply detailed filtering logic, or depend on

311
00:15:53,520 --> 00:15:58,000
old custom rules that took years to build, replacing that setup with a simpler tool, without

312
00:15:58,000 --> 00:16:00,720
checking every rule, can create problems.

313
00:16:00,720 --> 00:16:02,400
Exchange hybrid can also affect the choice.

314
00:16:02,400 --> 00:16:06,560
A company may still run parts of Exchange locally while using Exchange Online.

315
00:16:06,560 --> 00:16:10,200
Some Exchange tasks need details written back into Active Directory.

316
00:16:10,200 --> 00:16:15,080
So Microsoft 365 and the local Exchange Setup keep agreeing about mail-related information.

317
00:16:15,080 --> 00:16:18,960
Your exact Exchange Setup decides whether Cloud Sync supports what you need.

318
00:16:18,960 --> 00:16:20,800
That decision changed in 2026.

319
00:16:20,800 --> 00:16:23,800
Cloud Sync now includes Device Sync for Hybrid Entra ID join.

320
00:16:23,800 --> 00:16:27,640
That matters when company Windows devices still belong to local Active Directory, but also

321
00:16:27,640 --> 00:16:30,880
need an identity and Entra ID for Cloud Access and Management.

322
00:16:30,880 --> 00:16:34,320
For many companies, Device Sync kept Entra Connect in place.

323
00:16:34,320 --> 00:16:37,760
Now Cloud Sync can cover that need too, which removes one reason some teams could not

324
00:16:37,760 --> 00:16:39,120
attempt to consider it.

325
00:16:39,120 --> 00:16:42,880
You still need to check your device setup, your Windows plans, and how you use Intune, but

326
00:16:42,880 --> 00:16:45,800
the choice is no longer only about users and groups.

327
00:16:45,800 --> 00:16:49,480
Microsoft also added Exchange Hybrid attribute right back in public preview.

328
00:16:49,480 --> 00:16:53,160
In plain English, Cloud Sync can now send certain Exchange-related details from the Cloud

329
00:16:53,160 --> 00:16:55,080
back into Active Directory.

330
00:16:55,080 --> 00:16:59,000
Public preview means Microsoft is still gathering real world use and feedback before calling

331
00:16:59,000 --> 00:17:03,120
the feature fully released, so treat it with more care than a long established feature.

332
00:17:03,120 --> 00:17:07,440
So note them to move and Exchange setup based on one sentence in a product update.

333
00:17:07,440 --> 00:17:11,440
Read the current Microsoft documentation, test with non-production accounts, and confirm

334
00:17:11,440 --> 00:17:14,000
the exact attributes your company needs.

335
00:17:14,000 --> 00:17:18,080
Exchange can be unforgiving when identity details don't know the team match.

336
00:17:18,080 --> 00:17:20,840
Cloud Sync also brings familiar safety controls into the portal.

337
00:17:20,840 --> 00:17:24,800
You can use password hash sync, you can set notifications, so the right people hear about

338
00:17:24,800 --> 00:17:28,320
a problem, you can set accidental deletion protection.

339
00:17:28,320 --> 00:17:31,960
You can manage the configuration from Entra instead of treating the local Sync server

340
00:17:31,960 --> 00:17:33,240
as the center of everything.

341
00:17:33,240 --> 00:17:35,040
The tools are getting closer in coverage.

342
00:17:35,040 --> 00:17:39,280
Still, Cloud Sync is now a tamter replacement for Entra Connect in every company.

343
00:17:39,280 --> 00:17:41,320
Think of the choice like choosing a vehicle.

344
00:17:41,320 --> 00:17:45,960
A small van may suit a local delivery route because it out TME says easy to run and easy

345
00:17:45,960 --> 00:17:46,960
to park.

346
00:17:46,960 --> 00:17:50,560
A heavy truck suits a different job because it carries loads the van can out and neither

347
00:17:50,560 --> 00:17:51,560
choice is wrong.

348
00:17:51,560 --> 00:17:53,840
Ask a few direct questions before you decide.

349
00:17:53,840 --> 00:17:57,840
Do you have one Active Directory forest or several disconnected forests?

350
00:17:57,840 --> 00:17:59,240
Do you need Hybrid Device Sync?

351
00:17:59,240 --> 00:18:01,120
Do you rely on advanced custom rules?

352
00:18:01,120 --> 00:18:02,960
Which sign in method do you use?

353
00:18:02,960 --> 00:18:04,480
Does Exchange need right back?

354
00:18:04,480 --> 00:18:08,040
And if the current sync service fails, how quickly can you recover?

355
00:18:08,040 --> 00:18:09,040
Write down the answers.

356
00:18:09,040 --> 00:18:10,600
The final decision should note them.

357
00:18:10,600 --> 00:18:12,200
Start with an all at once migration.

358
00:18:12,200 --> 00:18:16,480
It should start with a small control test that proves Cloud Sync can handle your actual

359
00:18:16,480 --> 00:18:19,120
accounts and your actual requirements.

360
00:18:19,120 --> 00:18:21,800
A safe first move for your company.

361
00:18:21,800 --> 00:18:23,840
Start by drawing a simple identity map.

362
00:18:23,840 --> 00:18:26,520
List every Active Directory forest and domain.

363
00:18:26,520 --> 00:18:30,200
Note whether you already run Entra Connect which users sync today which devices need Hybrid

364
00:18:30,200 --> 00:18:33,880
identity and where your mail system still depends on local Active Directory.

365
00:18:33,880 --> 00:18:34,880
Keep it plain.

366
00:18:34,880 --> 00:18:37,160
Then compare your needs against current Cloud Sync support.

367
00:18:37,160 --> 00:18:38,760
Check your sign in method first.

368
00:18:38,760 --> 00:18:40,160
Check Exchange requirements.

369
00:18:40,160 --> 00:18:44,280
Check devices right back and any custom mappings that someone added years ago and nobody

370
00:18:44,280 --> 00:18:45,600
has looked at since.

371
00:18:45,600 --> 00:18:49,760
That list can expose hidden dependencies if Cloud Sync fits install at least two provisioning

372
00:18:49,760 --> 00:18:51,240
agents for production.

373
00:18:51,240 --> 00:18:56,080
One agent may work in a lab, but production identity sync should note MET, the rest on

374
00:18:56,080 --> 00:18:57,960
one server if you can avoid it.

375
00:18:57,960 --> 00:18:59,560
Build a narrow configuration next.

376
00:18:59,560 --> 00:19:02,680
Choose a test organizational unit or small security group.

377
00:19:02,680 --> 00:19:05,640
Use the default mappings unless you have a clear reason to change them.

378
00:19:05,640 --> 00:19:10,040
Then choose a known user and run provision on demand before you enable regular syncing.

379
00:19:10,040 --> 00:19:11,280
Read the result carefully.

380
00:19:11,280 --> 00:19:15,320
Check whether Entra finds the right person, creates the expected account and sends the expected

381
00:19:15,320 --> 00:19:16,320
fields.

382
00:19:16,320 --> 00:19:20,240
Look at the portal logs too because a green status alone does know Tim, Tim, the prove

383
00:19:20,240 --> 00:19:21,800
your business rules work.

384
00:19:21,800 --> 00:19:23,800
One warning matters during a move.

385
00:19:23,800 --> 00:19:28,760
So no Tim, let Entra connect and Cloud Sync manage the same objects without a documented migration

386
00:19:28,760 --> 00:19:29,760
plan.

387
00:19:29,760 --> 00:19:33,160
Two sync tools trying to control one account can create conflicts unexpected changes or

388
00:19:33,160 --> 00:19:34,520
deleted accounts.

389
00:19:34,520 --> 00:19:38,680
With a careful pilot you can reduce local maintenance, see the sync status in Entra and bring

390
00:19:38,680 --> 00:19:43,440
in a new office or newly acquired company without rushing the larger identity work in those.

391
00:19:43,440 --> 00:19:45,280
Put the right bridge in place.

392
00:19:45,280 --> 00:19:49,600
Cloud Sync moves much of the identity processing into Microsoft Entra while small local agents

393
00:19:49,600 --> 00:19:52,240
keep active directory connected to the cloud.

394
00:19:52,240 --> 00:19:56,860
That gives many companies a lighter setup built in agent failover support for disconnected

395
00:19:56,860 --> 00:20:01,600
forests and broader hybrid identity coverage in 2026.

396
00:20:01,600 --> 00:20:05,880
Before changing anything write down one Entra connect feature your company uses today.

397
00:20:05,880 --> 00:20:08,920
Then compare that feature with current Cloud Sync support including the release status and

398
00:20:08,920 --> 00:20:09,920
limits.

399
00:20:09,920 --> 00:20:14,160
Don't know Tim, T gas especially with sign-in methods, devices or exchange.

400
00:20:14,160 --> 00:20:18,400
A follow-up episode will compare Entra connect and Cloud Sync in more detail including how

401
00:20:18,400 --> 00:20:21,040
to plan a safe move between them.

402
00:20:21,040 --> 00:20:25,560
These sync decides who can enter Microsoft 365 so test the bridge with a small group before

403
00:20:25,560 --> 00:20:26,640
you open it to everyone.