AD Connect vs. Cloud Sync: What’s Actually Different – and How to Set Each One Up
Both tools bridge your on-premises Active Directory with Microsoft Entra ID. But they run on different architecture, support different features, and Microsoft is steering everyone toward one of them. Here’s the plain-English breakdown.
Quick terminology check: “AD Connect” almost always refers to what Microsoft now calls Microsoft Entra Connect (Sync) – it was renamed from Azure AD Connect. “Cloud Sync” is short for Microsoft Entra Cloud Sync. Both do the same basic job – sync identities between your local AD and the cloud – but they get there very differently.
The core difference
Entra Connect installs a full synchronization engine on a Windows Server that you own and maintain. It talks to a local SQL database, runs its own scheduler, and gives you deep, granular control over how objects and attributes flow between AD and Entra ID.
Cloud Sync flips that model. The actual sync logic and orchestration live in Microsoft’s cloud. What you install on-premises is a small, lightweight provisioning agent that simply relays requests – it authenticates to Entra ID, pulls what the cloud service asks for, and forwards data back. There’s no local database, no dedicated sync server, and configuration happens entirely in the Entra admin center rather than a desktop console.
That single architectural choice – engine-on-prem vs. engine-in-the-cloud – is what drives almost every other difference between them.
Side-by-side comparison
| Entra Connect (AD Connect) | Entra Cloud Sync | |
|---|---|---|
| Where it runs | Full sync engine on a dedicated Windows Server | Lightweight agent on-prem; orchestration in Microsoft’s cloud |
| Database | SQL Server LocalDB or full SQL Server, hosted locally | None – no local database to patch or back up |
| Configuration | Local console app (Synchronization Service Manager) | Entra admin center, entirely cloud-managed |
| Multi-forest support | Yes, including complex or disconnected forest topologies | Yes for connected forests; improving for disconnected/complex setups |
| High availability | Requires a staging server you configure yourself | Built in – install multiple agents for automatic failover |
| Sign-in methods | Password Hash Sync, Pass-through Auth, AD FS federation | Password Hash Sync (the recommended default for both tools) |
| Advanced features | Password/device writeback, Exchange hybrid, custom attribute flows | Core user/group/contact sync; advanced features expanding steadily |
| Filtering | Deep, attribute-based rule editor | OU-based scoping, plus growing attribute-based options |
| Maintenance overhead | Server patching, SQL upkeep, manual upgrades | Microsoft manages the service; you just keep agents updated |
| Microsoft’s direction | Being phased out – see the migration note below | The strategic default for new deployments |
Why the two exist – and why it matters right now
Entra Connect has been the workhorse of hybrid identity for over a decade, going back to DirSync and Azure AD Sync. It’s mature, deeply customizable, and still the only option for a handful of advanced scenarios like Exchange hybrid writeback or highly complex multi-forest layouts.
Cloud Sync is the newer model Microsoft built to remove the operational weight of running a sync server: no more patch cycles, no local SQL instance to babysit, and built-in high availability just from adding more agents. As Cloud Sync has matured, Microsoft has closed most of the feature gap, and it’s now the tool they recommend for the majority of new hybrid identity setups.
Microsoft has confirmed it is deprecating Entra Connect Sync in favor of Cloud Sync. Notifications began rolling out in mid-2026 through the Microsoft 365 Message Center, Entra Connect Health, and direct email, with migrations happening in phases based on how well Cloud Sync already covers your configuration.
Microsoft begins notifying tenants whose Entra Connect setup is already fully covered by Cloud Sync’s current feature set – these organizations move first.
Organizations relying on advanced Entra Connect–only features (large directories, complex filtering, Exchange hybrid writeback) are notified in later waves as Cloud Sync’s capabilities catch up.
Entra Connect Sync versions older than 2.5.79.0 stop being supported – check your version now if you’re still running it, regardless of migration timing.
Migration dates and phase details are set by Microsoft and can shift – check the Microsoft 365 Message Center and Microsoft’s official decision guide for your tenant’s actual timeline before making changes.
How to set each one up
Both tools connect the same two environments, but the setup path looks quite different. Here’s the short version of each.
Entra Connect (AD Connect)
On-premises install- Provision a Windows Server (2016+) meeting the sizing requirements for your directory – a few CPU cores, 8 GB+ RAM, and SSD storage.
- Download
Microsoft Entra Connectfrom Microsoft and run the installer with Express or Custom setup. - Provide Global Administrator credentials for Entra ID and Enterprise Admin credentials for on-prem AD.
- Choose your sign-in method – Password Hash Sync is the default recommendation unless you need PTA or AD FS.
- Select which OUs and domains to sync, and configure any attribute filtering you need.
- Run initial synchronization and verify objects appear correctly in the Entra admin center.
- Optionally configure a second server in staging mode for high availability.
Entra Cloud Sync
Cloud-managed, agent-based- In the Entra admin center, go to Identity → Hybrid management → Microsoft Entra Connect → Cloud sync and start a new configuration.
- Download the lightweight
Microsoft Entra Provisioning Agentand install it on a domain-joined server (no dedicated hardware needed). - Authenticate the agent with an Entra ID admin account when prompted during install.
- Back in the admin center, select your on-prem AD domain and choose which OUs to scope in.
- Review the default attribute mappings, or adjust scoping filters as needed.
- Save and enable the configuration – the cloud service takes over orchestration from here.
- Install a second agent on another server for automatic failover and high availability.
Which one should you actually pick?
- Starting fresh? Default to Cloud Sync unless you already know you need an Entra Connect–only feature.
- Simple, single-forest environment with standard sign-in needs? Cloud Sync will almost certainly cover you, with far less to maintain.
- Need password writeback, device writeback, Exchange hybrid, or complex multi-forest filtering? Stay on Entra Connect for now, but start reading Microsoft’s migration guidance.
- Already running Entra Connect and it works fine? No need to rush – but plan for the eventual move, since deprecation notices are already going out.
- Mid-migration or testing? The two can run in parallel, as long as they’re not syncing the same objects into the same tenant.
