Microsoft Entra Cloud Sync provides organizations with a cloud-managed way to synchronize identities from on-premises Active Directory into Microsoft Entra ID. But how is it different from Microsoft Entra Connect, why would an organization choose it, and what has changed in 2026? In this episode of Microsoft Knowledge Nuggets on M365 FM, we break down Entra Cloud Sync from the basic identity problem through architecture, high availability, scoping, security, hybrid environments, and the decision between Cloud Sync and Entra Connect.

WHY IDENTITY SYNCHRONIZATION STILL MATTERS
Many organizations still maintain employee identities inside Active Directory while their employees increasingly work in Microsoft 365. A new employee might be created in the local directory but immediately need Microsoft Teams, Exchange Online, SharePoint, OneDrive, and other cloud applications. Without synchronization, IT effectively has two identity environments to maintain.Identity synchronization connects those worlds. Changes to an employee's identity can begin in Active Directory and then flow into Microsoft Entra ID instead of requiring administrators to maintain two independent accounts. This becomes especially important when employees join the company, change departments, receive different permissions, change passwords, or leave the organization.

THE TRADITIONAL ENTRA CONNECT MODEL
Microsoft Entra Connect has traditionally handled this connection by running a synchronization engine inside the organization's network. It reads Active Directory, processes synchronization rules locally, maintains its own local components, and sends approved identity changes to Microsoft Entra ID.That architecture provides considerable flexibility, particularly for organizations with sophisticated synchronization requirements. But flexibility also creates operational responsibility. The synchronization server must be maintained, patched, monitored, understood, and incorporated into disaster-recovery planning.If the synchronization infrastructure becomes unavailable, changes may stop reaching Microsoft 365 until the service is restored. For a large organization, this can affect new employees, departing employees, permissions, password changes, and everyday support operations.

WHAT MICROSOFT ENTRA CLOUD SYNC ACTUALLY IS
Microsoft Entra Cloud Sync changes where much of the synchronization work happens. Instead of operating a large synchronization engine within the company's environment, more of the processing is managed by Microsoft Entra in the cloud.A lightweight provisioning agent remains inside the local network. That agent can communicate with Active Directory and establish an outbound connection to Microsoft Entra. It reads approved directory information and securely communicates it to the cloud, where Entra performs much of the provisioning processing.This means organizations can continue using Active Directory as the source of employee identity information without maintaining the same type of large local synchronization engine.

THE PROVISIONING AGENT
The provisioning agent is one of the most important architectural differences to understand. Think of it as a secure courier between Active Directory and Microsoft Entra ID. It can access the local directory because it operates inside the organization's network, while its outbound connection allows it to communicate securely with Microsoft Entra.Microsoft Entra then evaluates whether an identity already exists, applies the configured synchronization scope and attribute mappings, and creates or updates the corresponding cloud identity when appropriate.Administrators manage much of this configuration through the Microsoft Entra portal rather than treating a local synchronization server as the center of the architecture.ㅤ

ATTRIBUTE MAPPING AND SOURCE OF AUTHORITY
Organizations still control which identity information should move between Active Directory and Microsoft Entra ID. Attribute mappings determine which local fields correspond to fields in the cloud identity.An employee's display name, department, manager, telephone number, or other information can therefore flow from Active Directory into Entra ID. Cloud Sync provides default mappings for common scenarios and also supports adjustments when organizations have specific requirements.An important principle remains: when an identity is synchronized from Active Directory, Active Directory normally remains the source of authority for those synchronized properties. If an employee changes department, for example, the organization updates that information at its authoritative source and synchronization carries the change into Entra ID.ㅤ

PASSWORD HASH SYNCHRONIZATION
Cloud Sync can also support password hash synchronization. Despite the terminology, this does not mean sending a readable employee password into Microsoft Entra.Protected password verification information can be synchronized so Microsoft Entra ID can validate the user's cloud sign...