Entra Connect: Introducing Your Active Directory to the Cloud

Hi there! It's BOB.

Let's talk about a very common situation. You've had an Active Directory domain since roughly the Bronze Age. It's full of users, groups, and a few service accounts named things like svc_DONOTDELETE. Now you've moved to Microsoft 365, and suddenly every user needs a cloud account too.

You could create them all by hand, and then keep two sets of passwords in sync forever.

Or you could let Entra Connect do it for you.

I know which one I'd pick. Let's go!

So… What Is Entra Connect?

Microsoft Entra Connect (formerly Azure AD Connect. Microsoft renamed it. Microsoft renames everything. It's a whole thing) is a free tool you install on a Windows Server in your network.

Its job is simple to describe: it copies your on-premises Active Directory users, groups and devices up to Microsoft Entra ID, and keeps them in sync.

• Create a user in AD → they appear in Entra ID.
• Change their job title in AD → it changes in Entra ID.
• Disable them in AD → they're disabled in Entra ID.

This setup, with one identity living in both places, is called hybrid identity. Your on-premises AD stays the source of truth. You keep managing users the way you always have, in Active Directory Users and Computers, and the cloud just follows along.

💡 BOB's tip: Once a user is synced, you edit them in on-premises AD, not in the Entra admin center. Entra ID will politely gray out most fields and remind you that it's not in charge.

How Do Users Sign In?

Syncing the accounts is half the story. Entra Connect also sets up how users prove who they are in the cloud. You get three choices:

Password hash sync is Microsoft's recommendation for most organizations, and mine too. It's the simplest, it keeps working when your internet connection or datacenter takes a nap, and it lets Entra ID warn you when a user's password shows up in a breach.

💡 BOB's tip: Nervous about PHS? Entra ID never gets the actual password. It gets a hash of a hash that's been salted and run through thousands of rounds of hashing. It's a very scrambled egg.

Entra Connect vs. Entra Cloud Sync

Before we install anything, a quick note. Microsoft also offers Entra Cloud Sync, a lighter-weight cousin that uses small agents and keeps its configuration in the cloud.

Microsoft is steadily moving features to Cloud Sync, so it's worth a look for new setups. But Entra Connect is still the one most organizations run, so that's what we're installing today.

Before You Start: The Checklist

A little preparation saves a lot of "huh, that's weird" later.

Your server

• Windows Server 2016 or newer (2022 or 2025 if you're building fresh), with the full desktop experience. Server Core isn't supported.
• Joined to your domain.
• Ideally not a domain controller. It's supported, but a dedicated member server is cleaner.
• TLS 1.2 enabled (it is by default on modern Windows Server).
• At least 4 GB RAM and 70 GB of disk for small environments. More if you have lots of objects.
• Entra Connect installs SQL Server Express LocalDB for you. It's good for about 100,000 objects. Bigger than that? Point it at a full SQL Server.

⚠️ Heads up: Treat the Entra Connect server like a domain controller. It can touch every identity you own. Lock it down, patch it, and don't let people browse the internet from it.

Your accounts

• In Entra ID: an account with the Hybrid Identity Administrator role (or Global Administrator) to run the wizard.
• In AD: an Enterprise Admin account for the Express install. The wizard uses it once to create a less-privileged service account for day-to-day syncing. It doesn't keep the Enterprise Admin credentials.

Your domain names

This one trips up everyone, so pay attention!

1. Add and verify your domain in Entra ID (like contoso.com). Go to Entra ID → Domain names → Add custom domain and add the DNS TXT record it gives you.
2. Check your users' UPNs. A user's User Principal Name (jeff@contoso.com) becomes their cloud sign-in name. If your AD domain is something like contoso.local, that's not a domain you can verify on the internet.
3. If needed, add a UPN suffix in Active Directory Domains and Trusts (right-click the top node → Properties → add contoso.com), then change your users' UPNs to use it.

⚠️ Heads up: If a user's UPN uses a domain that isn't verified in Entra ID, they'll get synced with an ugly @contoso.onmicrosoft.com address instead. They won't be happy. You won't be happy. Nobody will be happy.

Clean up your directory

Run Microsoft's free IdFix tool against your AD first. It finds duplicate email addresses, bad characters, and other junk that would make sync fail. It's like vacuuming before company comes over.

Installing Entra Connect

Alright, here we go!

1. Download it

In the Entra admin center (entra.microsoft.com), go to Entra ID → Entra Connect → Get started (or Manage → Connect Sync) and download the installer. Copy it to your sync server.

2. Run the installer

Double-click AzureADConnect.msi. (Yes, the file name still says Azure AD. Naming is hard.) Agree to the license terms and click Continue.

3. Express or Custom?

The wizard offers Use express settings. Express does the following:

• Turns on password hash sync
• Syncs every user, group and device in every domain of your forest
• Turns on automatic upgrades
• Starts syncing right away

That's great for a small, tidy, single-forest environment. For most real-world networks, I'd click Customize instead so you can choose what gets synced. Let's walk through Customize.

4. Install required components

Leave the boxes unchecked unless you have a reason (like using your own SQL Server), and click Install.

5. User sign-in

Pick your sign-in method: Password Hash Synchronization (remember, BOB recommends it).

While you're here, check Enable single sign-on. This turns on Seamless SSO: users on domain-joined PCs inside your network get signed into Microsoft 365 automatically, with no password prompt.

6. Connect to Entra ID

Sign in with your Hybrid Identity Administrator account.

7. Connect your directories

Your forest is listed. Click Add Directory, choose Create new AD account, and enter your Enterprise Admin credentials. The wizard creates a service account (named MSOL_ followed by a bunch of characters) with just the permissions sync needs.

8. Entra ID sign-in configuration

Here you'll see the UPN suffixes in your AD and whether each one is Verified in Entra ID. Remember that domain names homework? This is where it pays off. Everything your users actually use should say Verified.

Leave userPrincipalName as the sign-in attribute unless you have a very good reason to change it.

9. Domain and OU filtering

My favorite step! Choose Sync selected domains and OUs and check only the OUs that hold real people, groups and computers you want in the cloud.

Leave out things like service accounts, disabled-user OUs, and that "Old Stuff 2009" OU everyone's afraid to open.

💡 BOB's tip: Start small. Sync a single test OU with a few test users, check that everything looks right in Entra ID, and then add more OUs. It's much easier to add than to take away.

10. Uniquely identifying your users

Accept the defaults:

• Users are represented only once across all directories
• Source anchor: let Azure manage it. It uses ms-DS-ConsistencyGuid, a value that never changes, which permanently ties the AD user to their cloud account.

11. Filter users and devices

Synchronize all users and devices (within the OUs you picked) is fine for most people.

12. Optional features

You'll see a list of extras, such as Password writeback (lets users reset their password in the cloud and have it written back to AD) and Exchange hybrid deployment.

For a basic setup, Password hash synchronization is already checked. Password writeback is a nice one to add if you're planning self-service password reset (it needs Entra ID P1).

13. Enable single sign-on

If you checked Seamless SSO back in step 5, the wizard asks for Domain Administrator credentials for each forest. It creates a computer account named AZUREADSSOACC in AD. Don't delete it. (Seriously. Put a note on it.)

14. Ready to configure

Two checkboxes here:

• Start the synchronization process when configuration completes. Leave this on.
• Enable staging mode. Leave this off for your first server. (More on staging mode below.)

Click Install and go get a coffee. ☕

Did It Work?

When the wizard finishes, give it a few minutes, then:

1. In the Entra admin center, go to Entra ID → Users → All users. Your AD users should appear with On-premises sync enabled: Yes.
2. Go to Entra ID → Entra Connect and check that sync status is Enabled and Last sync shows a recent time.
3. On the sync server, open Synchronization Service from the Start menu. It shows every sync run and any errors.

Have a test user sign in at portal.office.com with their normal AD username and password. If they get in, congratulations! You're officially hybrid. 🎉

💡 BOB's tip: Users still need a Microsoft 365 license to use email, Teams and so on. Syncing them creates the account; licensing gives them the stuff. Group-based licensing makes this automatic.

Handy PowerShell for Everyday Life

By default, Entra Connect syncs changes every 30 minutes. When you can't wait that long (and let's be honest, you never can), run these on the sync server:

Import-Module ADSync                          # load the sync module

Get-ADSyncScheduler                           # when's the next sync? is it on?

Start-ADSyncSyncCycle -PolicyType Delta       # sync recent changes now

Start-ADSyncSyncCycle -PolicyType Initial     # full sync (after changing filtering or rules)

Set-ADSyncScheduler -SyncCycleEnabled $false  # pause syncing (maintenance)
Set-ADSyncScheduler -SyncCycleEnabled $true   # turn it back on

Things BOB Wishes Someone Had Told Him

⚠️ Deleting an OU from sync deletes those users from Entra ID. If you uncheck an OU, the users in it get soft-deleted in the cloud (along with their mailboxes' access). They can be restored for 30 days, but it's not a fun afternoon. By default, Entra Connect refuses to delete more than 500 objects in one go. That's the accidental deletion protection. Don't turn it off.

⚠️ One active server per tenant. You can't have two Entra Connect servers both actively syncing to the same tenant. You can have a second server in staging mode: it syncs and calculates everything but doesn't export any changes. It's a warm spare, and a great way to test upgrades or configuration changes.

💡 Roll the Seamless SSO key. Microsoft recommends changing the Kerberos key on the AZUREADSSOACC account at least every 30 days. There's a PowerShell procedure for it in Microsoft's docs. Put it on the calendar.

💡 Keep it updated. Leave automatic upgrade on if you can, and check the version now and then. Very old versions stop working when Microsoft retires the things they depend on.

Wrapping Up

So there you have it:

• Entra Connect copies your on-premises AD users, groups and devices to Entra ID and keeps them in sync.
• AD stays the boss. Manage users there.
• Use password hash sync unless you have a strong reason not to, and turn on Seamless SSO while you're at it.
• Do your homework first: verify your domains, fix UPNs, run IdFix.
• Start with a test OU, check the results, then grow from there.

Your users get one username and password for everything, and you get to keep managing them the way you always have.

And if you want to take that one sign-in even further and use it for all your other apps too? Check out my article on Entra ID single sign-on.

See you next time!

— BOB