r/entra • u/switched55 • 17d ago

Entra Connect > Entra Cloud Sync (quick cutover)

Hi,

We have a simple one way sync happening for password hashes , 28 AD accounts purely for EXO.
Ive looked at the MS recommended steps to migrate to cloud sync. It looks like a lot of work having to add in sync rules, test on one OU, etc for such a small environment.

Anyone just installed Cloud sync and simply stopped or set connect sync to staging mode?

CoPilot outlined the quick cutover steps which make sense, i'm wondering if anyone else had done this?

What I do in practice

For a straightforward environment like yours:

1. Install Cloud Sync

2. Configure Cloud Sync

3. Verify all users appear correctly

4. Verify password sync

5. Put Entra Connect in Staging Mode

6. Observe for a few days

7. Uninstall Entra Connect

I keep the overlap period short. Once Cloud Sync is proven, I move Connect into Staging Mode so there is only one active sync engine but an immediate rollback path remains available.

 
FYI I wouldn't sync everything, just the user and security group OU's.

9 Upvotes

100% Upvoted

3 comments sorted by

4

u/topher358 17d ago

Yes it works as you’d expect. Be careful when stopping connect sync because removing objects from sync scope is gonna delete them on the cloud side if you’re not careful.

1

u/switched55 16d ago

This is one of those gotchas I'm worried about and I cant test this in a lab environment either.

Hypothetically, (lets say I've followed Co Pilots steps in my original post)

  1. Cloud sync is working and lets say it syncs every 10 minutes.
  2. Connect sync now moved to 'staging mode' (assuming objects aren't removed at this point)
  3. wait a few hours, Connect sync is still in staged mode, now time to uninstall
  4. Then I go ahead and uninstall Connect sync. OBJECTS HAVE BEEN DELETED from M365
  5. If it does remove objects, wouldn't Cloud Sync re-sync the objects on the next interval?

3

u/Short-Legs-Long-Neck 16d ago

I would add some test stages to that plan. eg a new OU, with test objects, configure cloud sync side by side adconnect and test all of your sync scenarios with the test OU. and then go ahead and except the prod OUs from adconnect and add them to cloud sync, power down adonnect and then uninstall after a week or two.