Microsoft Entra ID

Migrate Connect Sync Cloud Sync Tool

21 October 2026Doc updateAction required+62 / −2 lines

In brief

The guide now clarifies that migration must start from the active Connect Sync server, identifies device synchronization as a guided-migration blocker, explains readiness results, and adds validation and support-evidence checklists.

What Entra admins need to know

Administrators should follow the readiness results, avoid bypassing blockers, keep Connect Sync installed during the two-week validation period, and use tenant-specific migration dates.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

#customer intent: As a hybrid identity administrator, I want to migrate from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync so that I can validate synchronization after Cloud Sync becomes active.

Use the guided migration tool to move supported synchronization settings from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync. The tool assesses your environment, creates the required Cloud Sync configurations, and performs a preactivation Provision on Demand check. It then places Connect Sync in staging mode, activates Cloud Sync, and guides you through postactivation validation. Before you begin, review the prerequisites and supported migration scenarios.

Prerequisites

An account with the Hybrid Identity Administrator

Prerequisites

An account with the Hybrid Identity Administrator role to connect to Microsoft Entra and create and manage Cloud Sync configurations.
Access to the active Microsoft Entra Connect Sync server. You can't run the migration tool from a server in staging mode.
A two-week validation period after migration. Keep Microsoft Entra Connect Sync installed during this period.

The migration tool supports transferring the following synchronization scenarios:

User synchronization.

The readiness review can include domains, scope, enabled features, authentication-related settings, writeback settings, object limits, existing Cloud Sync agents or configurations, and unsupported synchronization rules. The wizard also displays the Connect Sync accidental-deletion protection setting and deletion threshold. These settings must be readable and valid before migration can continue.

Use the readiness results to determine your next action:

Readiness result	What it means	Customer action
Supported	The scenario can proceed through the guided migration tool.	Review the assessment and continue.
Attention required	The environment contains a setting that you need to review.	Follow the linked guidance and rerun or resume the assessment as documented.
Migration blocked	The environment doesn't meet the current guided-tool requirements.	Don't bypass the result. Remediate the documented condition, wait for the required capability, or request more time when applicable.

For feature, scope, and object-limit blockers, review the tool prerequisites. For device synchronization, review Device Sync. For accidental-deletion protection, see Accidental deletions.

To review the assessment and proceed when eligible:

Review each result and any blocking conditions.
Review the accidental-deletion protection setting and deletion threshold.
Enter the email address that should receive quarantine notifications.

If you need to wait for the next Connect Sync staging cycle, close the wizard so that it releases the Connect Sync configuration mutex. The wizard preserves the transition state. To resume validation, reopen Microsoft Entra Connect Sync, select Transition to Microsoft Entra Cloud Sync, review the overview, and sign in to Microsoft Entra again if prompted. Continue to the validation page and refresh the results.

What the migration tool does not validate automatically

The aggregate Total Objects comparison doesn't validate individual objects or business-specific outcomes. Manually validate:

Individual users and groups.
Group memberships and manager relationships.
Password hash synchronization results.
Password writeback and Exchange hybrid writeback.
Other business-critical object and attribute behavior.

Use this checklist before completing validation:

Confirm aggregate object counts.
Review Cloud Sync job health and last synchronization information.
Review provisioning errors.
Validate representative users and groups.
Validate group memberships and manager relationships used by your organization.
Validate every enabled writeback scenario.
Investigate persistent object-level differences.
Keep Connect Sync installed during the two-week validation period.

Request more time to migrate

Microsoft notifies eligible organizations through in-product experiences and email. The notification identifies your organization's migration window or deadline and directs you to the migration guidance.

If a confirmed technical or business blocker prevents you from completing the migration by the deadline in your notification, open a Microsoft Support request for a temporary Cloud Sync migration exception. Exceptions are reviewed individually, aren't guaranteed, and don't remove the requirement to migrate.

~~Include the following information in your support request:~~

~~The mitigations that you tried and why they didn't resolve the blocker.~~
~~A migration plan with milestones and a target completion date.~~

Submit evidence only through the secure Microsoft Support channel. Before you upload reports, logs, or screenshots, remove credentials, secrets, tokens, certificate material, personal data, internal hostnames, distinguished names, and unrelated tenant identifiers that Microsoft Support doesn't need for the investigation. Keep requested tenant and correlation identifiers so Support can investigate the issue.

Include the following information in your support request:

The mitigations that you tried and why they didn't resolve the blocker.
A migration plan with milestones and a target completion date.

For diagnostic evidence and redaction requirements, see Collect evidence for Microsoft Support.

Troubleshoot common issues

Issue	What to check	Support evidence to collect
Migration option is missing	Start on the active Connect Sync server, not a server in staging mode. Verify that the Connect Sync version is supported and that your organization and installation are eligible for the current migration wave. See Prerequisites.	Exact error text, if displayed, and a redacted screenshot.
Readiness review blocks migration	Review the blocking feature, scope, object limit, accidental-deletion protection setting, or configuration conflict.	Readiness report and a redacted screenshot of the blocking result.
Transfer fails	Review Connect Sync trace logs for credential validation, agent installation, registration, Microsoft Graph operations, or job creation failures.	Trace log excerpt, timestamp, wizard step, error text, and correlation identifier, if shown.
Activation fails	Follow the recovery instructions in the wizard. Don't delete, disable, or retag migration-owned Cloud Sync resources because manual changes can interfere with recovery.	Diagnostic ID, exported wizard logs, timestamp, wizard step, and error text.
Validation counts differ	Close the wizard while you wait for the next Connect Sync staging cycle. Reopen the wizard, return to validation, refresh the aggregate count comparison, and investigate persistent object-level differences.	Validation screenshot, last-sync times, job health, and relevant provisioning errors.
Existing Cloud Sync configuration is detected	Determine whether the existing configuration is a compatible writeback configuration or a conflicting Active Directory-to-Microsoft Entra configuration.	Configuration names, directions, scopes, and status, with tenant identifiers redacted.

Collect evidence for Microsoft Support

Collect the evidence relevant to the issue before you open a support request:

The readiness report.
Exact error text, the wizard step, and the timestamp.
A diagnostic or correlation ID, if displayed.
Exported wizard logs and relevant Connect Sync trace log excerpts.
Provisioning-agent health and Cloud Sync job status.
Provision on Demand result details.
Relevant provisioning errors and last synchronization information.
Redacted screenshots of the issue.

Related content

What is Microsoft Entra Cloud Sync?

@@ -7,7 +7,7 @@ ms.service: entra-id ms.subservice: hybrid-cloud-sync ms.topic: how-to ms.custom: msecd-doc-authoring-1028-ms.date: 09/16/2026+ms.date: 10/21/2026 ai-usage: ai-generated  #customer intent: As a hybrid identity administrator, I want to migrate from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync so that I can validate synchronization after Cloud Sync becomes active.@@ -17,6 +17,9 @@ ai-usage: ai-generated  Use the guided migration tool to move supported synchronization settings from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync. The tool assesses your environment, creates the required Cloud Sync configurations, and performs a preactivation Provision on Demand check. It then places Connect Sync in staging mode, activates Cloud Sync, and guides you through postactivation validation. Before you begin, review the prerequisites and supported migration scenarios. +> [!IMPORTANT]+> Start the migration from the active Connect Sync server. The migration tool can't be started from a Connect Sync server in staging mode.+ ## Prerequisites  - An account with the [**Hybrid Identity Administrator**](../../role-based-access-control/permissions-reference.md#hybrid-identity-administrator) role to connect to Microsoft Entra and create and manage Cloud Sync configurations.@@ -30,6 +33,11 @@ Use the guided migration tool to move supported synchronization settings from Mi - Access to the active Microsoft Entra Connect Sync server. You can't run the migration tool from a server in staging mode. - A two-week validation period after migration. Keep Microsoft Entra Connect Sync installed during this period. +> [!NOTE]+> Cloud Sync can support capabilities that the current guided migration tool doesn't transfer. The limits on this page describe eligibility for the guided experience, not the complete set of Cloud Sync capabilities. Review the [migration decision guide](connect-to-cloud-sync-decision-guide.md#comparison-between-microsoft-entra-connect-and-cloud-sync) separately.+>+> Cloud Sync supports device synchronization, but device synchronization is currently a migration blocker for the guided tool. Don't remove required device synchronization to bypass readiness. Review the decision guide and [Device Sync documentation](device-sync.md) before planning migration.+ The migration tool supports transferring the following synchronization scenarios:  - User synchronization.@@ -66,6 +74,18 @@ The tool verifies access to the current Microsoft Entra Connect Sync configurati  The readiness review can include domains, scope, enabled features, authentication-related settings, writeback settings, object limits, existing Cloud Sync agents or configurations, and unsupported synchronization rules. The wizard also displays the Connect Sync accidental-deletion protection setting and deletion threshold. These settings must be readable and valid before migration can continue. +Use the readiness results to determine your next action:++| Readiness result | What it means | Customer action |+| --- | --- | --- |+| Supported | The scenario can proceed through the guided migration tool. | Review the assessment and continue. |+| Attention required | The environment contains a setting that you need to review. | Follow the linked guidance and rerun or resume the assessment as documented. |+| Migration blocked | The environment doesn't meet the current guided-tool requirements. | Don't bypass the result. Remediate the documented condition, wait for the required capability, or [request more time](#request-more-time-to-migrate) when applicable. |++For feature, scope, and object-limit blockers, review the [tool prerequisites](#prerequisites). For device synchronization, review [Device Sync](device-sync.md). For accidental-deletion protection, see [Accidental deletions](how-to-accidental-deletes.md).++To review the assessment and proceed when eligible:+ 1. Review each result and any blocking conditions. 1. Review the accidental-deletion protection setting and deletion threshold. 1. Enter the email address that should receive quarantine notifications.@@ -142,10 +162,34 @@ Use the validation page to compare the Connect Sync staging result with the acti  If you need to wait for the next Connect Sync staging cycle, close the wizard so that it releases the Connect Sync configuration mutex. The wizard preserves the transition state. To resume validation, reopen Microsoft Entra Connect Sync, select **Transition to Microsoft Entra Cloud Sync**, review the overview, and sign in to Microsoft Entra again if prompted. Continue to the validation page and refresh the results. +### What the migration tool does not validate automatically++The aggregate **Total Objects** comparison doesn't validate individual objects or business-specific outcomes. Manually validate:++- Individual users and groups.+- Group memberships and manager relationships.+- Password hash synchronization results.+- Password writeback and Exchange hybrid writeback.+- Other business-critical object and attribute behavior.++Use this checklist before completing validation:++- Confirm aggregate object counts.+- Review Cloud Sync job health and last synchronization information.+- Review provisioning errors.+- Validate representative users and groups.+- Validate group memberships and manager relationships used by your organization.+- Validate every enabled writeback scenario.+- Investigate persistent object-level differences.+- Keep Connect Sync installed during the two-week validation period.+ ## Request more time to migrate  Microsoft notifies eligible organizations through in-product experiences and email. The notification identifies your organization's migration window or deadline and directs you to the migration guidance. +> [!IMPORTANT]+> Use the migration date in your organization's tenant-specific notification. Connect Sync version retirement, authentication changes, and Cloud Sync migration can have different timelines.+ If a confirmed technical or business blocker prevents you from completing the migration by the deadline in your notification, open a Microsoft Support request for a temporary Cloud Sync migration exception. Exceptions are reviewed individually, aren't guaranteed, and don't remove the requirement to migrate.  Include the following information in your support request:@@ -157,7 +201,7 @@ Include the following information in your support request: - The mitigations that you tried and why they didn't resolve the blocker. - A migration plan with milestones and a target completion date. -Submit evidence only through the secure Microsoft Support channel. Before you upload reports, logs, or screenshots, remove credentials, secrets, tokens, certificate material, personal data, internal hostnames, distinguished names, and unrelated tenant identifiers that Microsoft Support doesn't need for the investigation. Keep requested tenant and correlation identifiers so Support can investigate the issue.+For diagnostic evidence and redaction requirements, see [Collect evidence for Microsoft Support](#collect-evidence-for-microsoft-support).  ## Troubleshoot common issues @@ -165,6 +209,7 @@ Use the troubleshooting table to investigate migration issues and collect eviden  | Issue | What to check | Support evidence to collect | | --- | --- | --- |+| Migration option is missing | Start on the active Connect Sync server, not a server in staging mode. Verify that the Connect Sync version is supported and that your organization and installation are eligible for the current migration wave. See [Prerequisites](#prerequisites). | Exact error text, if displayed, and a redacted screenshot. | | Readiness review blocks migration | Review the blocking feature, scope, object limit, accidental-deletion protection setting, or configuration conflict. | Readiness report and a redacted screenshot of the blocking result. | | Transfer fails | Review Connect Sync trace logs for credential validation, agent installation, registration, Microsoft Graph operations, or job creation failures. | Trace log excerpt, timestamp, wizard step, error text, and correlation identifier, if shown. | | Activation fails | Follow the recovery instructions in the wizard. Don't delete, disable, or retag migration-owned Cloud Sync resources because manual changes can interfere with recovery. | Diagnostic ID, exported wizard logs, timestamp, wizard step, and error text. |@@ -172,6 +217,21 @@ Use the troubleshooting table to investigate migration issues and collect eviden | Validation counts differ | Close the wizard while you wait for the next Connect Sync staging cycle. Reopen the wizard, return to validation, refresh the aggregate count comparison, and investigate persistent object-level differences. | Validation screenshot, last-sync times, job health, and relevant provisioning errors. | | Existing Cloud Sync configuration is detected | Determine whether the existing configuration is a compatible writeback configuration or a conflicting Active Directory-to-Microsoft Entra configuration. | Configuration names, directions, scopes, and status, with tenant identifiers redacted. | +## Collect evidence for Microsoft Support++Collect the evidence relevant to the issue before you open a support request:++- The readiness report.+- Exact error text, the wizard step, and the timestamp.+- A diagnostic or correlation ID, if displayed.+- Exported wizard logs and relevant Connect Sync trace log excerpts.+- Provisioning-agent health and Cloud Sync job status.+- Provision on Demand result details.+- Relevant provisioning errors and last synchronization information.+- Redacted screenshots of the issue.++Submit evidence only through the secure Microsoft Support channel. Before you upload reports, logs, or screenshots, remove credentials, secrets, tokens, certificate material, personal data, internal hostnames, distinguished names, and unrelated tenant identifiers that Microsoft Support doesn't need for the investigation. Keep requested tenant and correlation identifiers so Support can investigate the issue.+ ## Related content  - [What is Microsoft Entra Cloud Sync?](what-is-cloud-sync.md)