Why would we choose Microsoft Entra Cloud Sync over Entra Connect Sync despite its feature limitations?

Shreya Kumari 20 Reputation points
2026-08-25T10:29:13.71+00:00

I'm trying to understand the real-world benefits of Microsoft Entra Cloud Sync over Microsoft Entra Connect Sync.

From what I understand, Entra Connect Sync currently supports several capabilities that Cloud Sync either doesn't support or has limitations around, such as:

  • Device synchronization

Password Hash Synchronization (PHS)

Password writeback

AD FS integration

More mature synchronization rules and customization options

At the same time, Microsoft introduced Entra Cloud Sync as a newer, more cloud-oriented synchronization solution.

So I'm trying to understand the actual use cases where Cloud Sync provides a significant advantage over Entra Connect Sync.

For example, what are the key benefits of Cloud Sync in areas such as:

Architecture and deployment

Scalability

High availability

Management and maintenance

Multi-forest environments

Reducing dependency on on-premises infrastructure

Performance

Microsoft’s long-term direction for identity synchronization

If Entra Connect Sync can already handle most enterprise synchronization requirements, what was the primary problem Cloud Sync was designed to solve? I'm trying to understand the real-world benefits of Microsoft Entra Cloud Sync over Microsoft Entra Connect Sync.

Thanks!

Shreya.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments
Answer accepted by question author
Marcin Policht 107.2K Reputation points MVP Volunteer Moderator
2026-08-25T11:09:07.46+00:00

The primary challenge Cloud Sync was designed to solve was not that Entra Connect Sync was inadequate at synchronization. It was that Connect Sync requires you to run and maintain a full synchronization engine on-premises. Cloud Sync moves the synchronization service into Microsoft Entra and uses lightweight provisioning agents on-premises to communicate with AD. This reduces the amount of identity infrastructure you have to deploy, patch, monitor, and maintain.

The biggest advantages are effectively simpler architecture, cloud-managed processing, easier scalability, and better support for distributed or multi-forest AD environments. Multiple provisioning agents can provide redundancy without having to maintain a traditional Connect Sync server configuration, and additional forests can be connected to the same Entra tenant without building a complex synchronization architecture around a single Connect Sync server.

However, Cloud Sync is not simply "Connect Sync but better." Connect Sync still has a broader feature set, including more advanced synchronization rules and customization, and it remains preferable when you need capabilities that Cloud Sync doesn't support or fully support. Performance is also not usually the reason to choose Cloud Sync; Connect Sync is already capable of handling very large directories.

So, for a simple single-forest environment where Connect Sync meets all requirements, Cloud Sync may provide little tangible benefit. Its real value is for organizations that want to minimize on-premises identity infrastructure, have multiple/distributed forests, or want synchronization to become increasingly cloud-managed. Microsoft is clearly positioning Cloud Sync as the longer-term direction, but Connect Sync remains important for scenarios requiring its more mature and extensive functionality.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-08-25T10:29:40.4466667+00:00

    Microsoft Entra Cloud Sync is chosen over Microsoft Entra Connect Sync when the priority is a cloud-managed, lower-maintenance, more resilient hybrid identity model rather than maximum feature breadth.

    The main problem Cloud Sync was designed to solve is the operational complexity and single-server dependency of Connect Sync. Connect Sync depends on on-premises server configuration and management. Cloud Sync moves provisioning orchestration and configuration into Microsoft Online Services and uses lightweight agents as secure bridges to Active Directory. That reduces on-premises infrastructure management and centralizes control in the Microsoft Entra admin center.

    Key real-world advantages of Cloud Sync:

    1. Cloud-managed architecture
      • Configuration, monitoring, and management are handled through the cloud service.
      • Administrators can modify sync configuration, monitor status, and troubleshoot without direct access to an on-premises sync server.
      • Changes are automatically distributed to agents.
    2. Higher availability and resilience
      • Connect Sync creates a single point of failure if the sync server is unavailable.
      • Cloud Sync supports multiple active agents, with automatic failover and load distribution.
      • Maintenance on one server does not stop synchronization if other agents are available.
    3. Reduced on-premises dependency
      • Cloud Sync uses lightweight provisioning agents instead of a full Connect Sync server.
      • This reduces server footprint, maintenance effort, and the need for VPN or direct server access for administration.
    4. Simpler management and maintenance
      • Agents automatically receive updates and security patches from Microsoft.
      • This reduces manual upgrade effort and lowers the risk of configuration drift across environments.
    5. Strong fit for disconnected and complex multi-forest environments
      • Cloud Sync natively supports multiple disconnected forests syncing to a single Microsoft Entra tenant.
      • This is called out as especially useful for mergers, acquisitions, and environments where forest consolidation is not feasible.
      • This is one of the clearest scenarios where Cloud Sync enables something Connect Sync does not.
    6. Strategic direction for new capabilities
      • Microsoft states that development focus for new synchronization and provisioning capabilities centers on Cloud Sync.
      • Examples called out include group provisioning to Active Directory, advanced source of authority management, and cloud-native identity scenarios.
    7. Modern deployment model
      • Agents can be deployed on existing domain controllers or standalone servers with minimal resource impact.
      • This gives more flexibility than maintaining a dedicated Connect Sync server.

    Where Cloud Sync is most compelling:

    • Organizations with multiple disconnected forests
    • Mergers and acquisitions needing rapid identity integration
    • Environments trying to eliminate single points of failure
    • Organizations pursuing cloud-first identity operations
    • Teams wanting to reduce on-premises sync infrastructure and maintenance

    Where Connect Sync may still be the better fit:

    • If device synchronization is required, because the comparison explicitly shows device synchronization is supported in Connect Sync and not currently supported in Cloud Sync.
    • If the environment depends on capabilities where Connect Sync still has broader support or fewer limits, such as larger group support or no 150K-per-domain Cloud Sync object limit.

    So the practical decision is not that Cloud Sync already does everything Connect Sync does. It is that Cloud Sync offers architectural and operational advantages:

    • cloud-managed administration
    • multiple active agents instead of a single sync server
    • easier maintenance
    • better support for disconnected forests
    • alignment with Microsoft’s future investment direction

    In short, Cloud Sync was designed to modernize hybrid identity synchronization by removing the heavy on-premises sync-server model and making synchronization more resilient, easier to manage, and better suited to complex multi-forest and cloud-first environments.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.