Introduction

Entra Cloud Sync is a new service from Microsoft. It supports organizations in reaching their hybrid identity objectives. This is done by syncing users, groups, and contacts to Microsoft Entra ID. Instead of using the Microsoft Entra Connect application, it utilizes the Microsoft Entra cloud provisioning agent.

This article provides an overview of Microsoft Entra Cloud Sync. It explains this cloud synchronization tool and its benefits. It also discusses appropriate use cases and implementation steps.

~~Azure AD account~~ is now Microsoft Entra account
~~Azure AD tenant~~ is now Microsoft Entra tenant
~~Azure AD account~~ is now Microsoft Entra account
~~Azure Active Directory~~ is now Microsoft Entra ID
~~Azure AD Connect~~ is now Entra Connect Sync
~~Azure AD Conditional Access~~ is now Microsoft Entra Conditional Access
~~Azure AD single sign-on~~ is now Microsoft Entra single sign-on

Benefits To organizations

Microsoft’s next-generation Cloud Sync solution is a lightweight agent. It is state-of-the-art and future-proof. This allows customers to reduce their on-premise infrastructure costs. It provides high availability and fault tolerance. It supports complex scenarios such as mergers and acquisitions. It co-exists with Entra Connect Sync. The provisioning cycle occurs frequently. There is reduced latency and decentralized on-premise directories, making it ideal for global organizations.

As a cloud service, it has more security than Entra Connect Sync and provides all the security controls. Microsoft will automatically update the software, eliminating customers’ need to upgrade to newer versions.

Supported Scenarios

The following section offers an overview of the different scenarios supported by Cloud Sync. It will detail the features of Cloud Sync and its application in achieving specific business objectives.

Hybrid configuration and seamless user experience

Imagine a small or medium sized company that manages user identities through an on-premise active directory. They also provide email services through an on-premise Exchange server. This company has now decided to migrate to Microsoft 365. This will offer cloud-based services for email, collaboration, and more in the future.

As per the business requirement, all users should be able to access both on-premises applications and cloud-based applications. They must use the same passwords for synced users.

In this scenario, the IT team can quickly deploy a Microsoft Entra cloud-providing agent. This deployment achieves a Hybrid Entra ID and Exchange Hybrid. It enables password hash, password writeback, and single-sign-on features.

Envision a retail company named MyForest1 with locations throughout the United States. They utilize an on-premises Active Directory for identity services. The headquarters, located in New York, is integrated with an Entra ID Tenant via Entra Connect Sync. All employees access Microsoft 365 services, such as Teams, email, OneDrive, and SharePoint Online.

The company has acquired another store called myforest2, which has a similar on-premise AD footprint. The goal is to enable the swift collaboration of both businesses in Microsoft Teams. Additionally, myforest2 users should be allowed to access myforest1 cloud services.

We can accomplish this goal by deploying a cloud sync agent within the myforest2 ecosystem. This agent will synchronize users, groups, and contacts.

Disconnected AD forest

There are multiple AD forests in a company that do not connect with each other. Despite this, they aim to synchronize users, groups, and contacts across one or more Entra ID tenants. They use Cloud Sync agents. These agents help them effortlessly synchronize all their on-premises users. They also synchronize groups and contacts with their Entra ID tenants.

Sync custom and directory extension attributes

Organizations need to synchronize custom and directory extension attributes. This process involves transferring data from Active Directory to Microsoft Entra ID. You can use directory extensions in Microsoft Entra ID. These extensions allow you to add your own attributes from on-premises Active Directory.

High availability and fault tolerance

The organization may require Cloud Sync high availability. This is to eliminate a single point of failure when syncing identities from on-premises to Microsoft Entra ID. Achieving this requires the installation of multiple cloud sync agents within an on-premises AD ecosystem.

We understand that a particular feature is required, but Microsoft Entra Connect Sync does not encompass it. We decided to switch the Staging server to Primary. This helped resume the sync operation after a single point of failure.

Reduce infrastructure investment costs

Envision a scenario where businesses aim to cut down their on-premises infrastructure costs. They are weary of the expenditures on SQL server licenses and the complexities of mergers and acquisitions. However, there exists a single solution that can resolve these challenges and streamline upgrade processes.

That’s right! Companies can save money by deploying Entra Connect Cloud Sync. They also save time. This allows them to focus on what matters – growing their business!

Un-Supported Scenarios

Sync On-premise devices to Entra ID

Under specific conditions, companies might have to synchronize their on-premises devices with the Entra ID tenant. Cloud Sync doesn’t support this functionality, so customers should opt for Microsoft Entra Connect sync.

Account-Resource forest topology

Customers may sometimes use an account-resource forest topology. In this topology, the account forests contain active user accounts. Meanwhile, the resource forests hold disabled accounts. These resource forests share services such as Exchange and Skype for Business.

Entra Connect Sync is necessary for such scenarios, as Cloud Sync does not currently support this configuration.

Large-scale synchronization

Suppose an enterprise or an organization wants to sync objects from their on-premise Active Directory to Entra ID tenants having more than 150K objects per domain. In that case, they may need to consider deploying Entra Connect Sync. As the default configuration of Entra Cloud Sync may not support such a large-scale synchronization, it is essential to evaluate the options available to ensure the successful synchronization of data.

Additionally, if your organization has any of the features deployed or configured, as outlined below, Cloud Sync does not support it.

Support for Pass-Through Authentication.
Filter on objects’ attribute values and Allow advanced customization for attribute flows.
Support for group writeback.
Connect to LDAP directories.

Consideration

Please consider the currently available technical features listed below before deploying Entra Connect Cloud Sync.

At any given time, only one Cloud agent is active.
Cloud provisioning runs every 2 minutes to provision user, group, and password hash changes to Microsoft Entra ID.
You need to restart the agent from the Entra ID portal to perform a full synchronization.
You can optionally specify the preferred domain controller for the agent; if not, the agent will use any available domain controller.
Agents handle synchronization automatically, so there’s no need for manual management. These agents will always upgrade to the latest version.
You can’t disable the agent and stop the auto-upgrade.
By default, cloud sync uses ms-ds-consistency-GUID with a fallback to ObjectGUID as source anchor. There’s no supported way to change the source anchor.
It’s not possible to install the agent on the server core.
It’s possible to install the Provisioning agent on the Entra Connect Sync Server.
By design, Cloud sync does not support Staging servers.
You can’t synchronize guest user accounts.
Cloud Sync does support OU renaming.
You can synchronize up to 50,000 group members.
For syncing Nested groups, I would suggest doing a Testing.

A Practical Example

Imagine a company named msetlab.com that has recently acquired the business unit and brand name of myforest1.com. As an identity architect tasked with fulfilling the company’s requirements, I adhered to the outlined steps to accomplish the end goal.

After the acquisition, msetlab has identified the key objective of this project as outlined here.

msetlab.com wanted to give all myforest1 staff the same identity as the brand. The UPN address user@myforest1.com will continue to be used for identification purposes.
The business has decided to collaborate quickly with myforest1.com through Microsoft Teams and grant access to all relevant cloud services before migrating their email services and other data to the msetlab.com tenant.
Myforest1.com users should be able to access both on-premises and cloud-based applications using the same passwords.
Myforest1.com users should be able to reset their passwords with Microsoft Entra self-service password reset (SSPR).
Myforest1.com Exchange on-premise objects need to sync to the Cloud.
They require high availability when syncing on-premise objects to the Cloud.
The business aims to decrease its expenses related to on-premises. Infrastructure.

Actual Architecture State

Myforest1.com has its own Active Directory and Microsoft Exchange infrastructure to provide identity and email services to its employees as they do not have an Entra ID tenant. However, only a few days have passed since the purchase, and there is no network connectivity between them.

Msetlab.com has a similar on-premises Windows Active Directory infrastructure. Entra Connect Sync is set up to synchronize its on-premises identities with Microsoft Entra ID. Every user is given an Office 365 E3 license.

Desired Architecture State

Please find the target architecture diagram.

Implementation Steps

Below are the steps taken to fulfill the business requirements.

Add a Domain to Microsoft 365

Myforest1.com was added to Entra ID Tenant. This was done to ensure that following synchronization to Entra ID, every user from myforest1 would have the identity user@myforest1.com.

To add myforest1.com to Entra ID, the following steps are taken.

I have used the PowerShell cmdlet “connect-msolservice” to establish a connection to Entra ID Tenant.
I added the domain myforest1.com to the Entra ID Tenant with the New-MsolDomain command.

I executed the command Get-MsoIDomainVerificationDNS to obtain the DNS TXT record.

I added a TXT record to the Public DNS registrar.

I have used the command Get-MsolDomain again to confirm the domain ownership.

Prerequisites

Two domain-joined Windows Server 2016 servers deployed with 4 GB RAM and .NET 4.7.1+ runtime.
PowerShell execution policy set to Remove Signed.
Enabled TLS 1.2 on both servers.
Ports 80 and 443 opened at the firewall side for agents to make outbound requests.

Install the Entra Connect Provisioning Agent

I connected to the Entra ID portal using the global administrator credentials through the following URL: https://entra.microsoft.com.
I navigated to Identity->Hybrid Management->Cloud Sync->Agents and downloaded the agent.

After the license terms and conditions were accepted, the provisioning agent was installed.

As soon as the installation is finished, the new wizard is opened to start the configuration. After that, I clicked the “Next” option to continue with the setup.

Selected the extension, HR-driven provisioning (Workday and SuccessFactors) / Microsoft Entra Connect cloud sync.

I selected the Authenticate button and entered my Global Administrator login information to manage the provisioning agent.

I have entered on-premise domain administrator credentials to create a gMSA account.

On the “Connect to Active Directory” wizard page, I verified that myforest1.com was added and selected the Next button.

I have reviewed the Agent configuration information and kick-off the installation.

The Exit button was clicked to close the Configuration wizard.

I have installed additional agents to achieve High availability.

Verify the Agent installation

Upon installing the agent, I discovered that those agents were registered with the Entra ID Tenant.

I confirmed that the Agent Updater service and provisioning agent were running on the server where the agent was installed.

As you can see in the image below, I have confirmed the agent version.

Configure Provisioning

I have installed two provisioning agents on the on-premises AD of myforest1.com. These agents are responsible for synchronizing objects with the Entra ID tenant.

It is time to enable Cloud Sync to synchronize objects with Entra ID. This is achieved by creating a New Cloud Sync Configuration and the Scoping filters method.

To create a new Cloud Sync Configuration, I performed the following steps:

I navigated to Identity->Hybrid Management Sync on the Entra ID admin portal ->Configurations->New Configuration->AD to Microsoft Entra ID Sync.

I enabled Password Hash Sync before launching the cloud sync configuration wizard.

In the Scoping Filters section, I added the Organization Unit’s name and selected the Save button.

I have reviewed and enabled the feature and finally clicked on the button that says “Review and Enable.”

I checked the configuration status, and it turned out to be healthy.

I have excluded the “On-Premises Directory Synchronization Service Account” service account from the Conditional access policy. This allows objects to sync to Entra ID.
Last but not least, I could sync myforest1.com user accounts, groups, and contacts with Entra ID through the Cloud Sync agent, as shown below.
I assigned the Office 365 E3 license to all users.

I deployed an office package for all their devices to access the Teams app.

Enable Password Writeback

On the Entra ID portal, I just navigated to Protection->Password Reset-> On-premises integration and enabled the settings below.

Write back passwords with Microsoft Entra Connect Cloud Sync.
Allow users to unlock accounts without resetting their password.

Enable Single Sign-on

I understand how important it is to have a seamless login experience. That’s why I followed these steps to enable single sign-on.

Download Microsoft Entra Connect software.
Run the command “msiexec /a C:filepathAzureADConnect.msi /qb TARGETDIR=C:filepathextractfolder” using administrative privileges to extract the content.

Import the Seamless SSO PowerShell module by using this command: Import-Module .AzureADSSO.psd1.

To obtain a list of Active Directory forests with SSO enabled, I logged in to the Entra ID portal and first used the command “New-AzureADSSOAuthenticationContext” and then “Get-AzureADSSOStatus.”. As you can see, SSO is enabled for msetlab.com.

Executed the command “Enable-AzureADSSOForest” and, when prompted, entered the domain administrator credentials to enable SSO for myforest1.com AD forest

SSO is enabled, as shown in the figure below.

To enable the feature on my Entra ID Tenant, I finally ran the command “Enable-AzureADSSO -Enable $true.”

Exchange Hybrid Writeback

I noticed that the Exchange hybrid writeback was turned off. So, I went ahead and enabled it.

Conclusion

Many organizations opt for cloud sync due to its speed and cost-effectiveness in synchronizing on-premises objects with Entra ID. However, despite its advantages, it’s essential to recognize that cloud sync has certain limitations.

One such limitation is that you have to compromise on certain features ( Listed below) that are available in Microsoft Entra Connect Sync solutions. It’s worth noting that Microsoft has decided that cloud sync can co-exist with Entra Connect Sync, providing organizations with a more comprehensive solution that meets their needs.

Cloud Sync Limitation.

Connect to LDAP directories
Support for device objects
Support for Pass-Through Authentication
Filter on objects’ attribute values
Allow advanced customization for attribute flows
Support for merging user attributes from multiple domains
Unlimited number of objects per AD domain
Large groups with up to 250,000 members

This comprehensive guide should equip you with the necessary knowledge and skills to plan and execute Microsoft Entra Cloud Sync in a smooth and effective manner.

The Ultimate Guide to Setting Up Microsoft Entra Cloud Sync