Entra Connect Sync vs Cloud Sync
Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync both copy users, groups and contacts from on-premises Active Directory into Microsoft Entra ID. The decision rule: choose Cloud Sync when the scenario stresses several disconnected forests, little infrastructure to maintain or agents that fail over; choose Connect Sync when it needs something only the full sync engine offers, such as custom sync rules, attribute merging across domains, very large scale or pass-through authentication set up by the installer. Microsoft’s own decision guide calls Cloud Sync the strategic direction and says new features are built mainly there, so “which is the modern option” usually points at Cloud Sync, but a hard requirement still wins over the trend.
Decide with the requirement, not with the product
The table below follows Microsoft’s feature comparison (the decision guide on Microsoft Learn, updated October 2026). Read the left column as the phrase you will see in a question.
| If the scenario says | Pick | Why |
|---|---|---|
| Two or more forests with no network connection between them | Cloud Sync | Disconnected forests are supported natively; Connect Sync does not support them |
| Avoid a single point of failure in sync | Cloud Sync | Several agents can be active at once and fail over automatically |
| Minimise servers and patching | Cloud Sync | A light agent that updates itself; configuration lives in the cloud |
| Provision groups from Entra ID back to Active Directory | Cloud Sync | Group provisioning to AD exists only in Cloud Sync |
| Custom or advanced synchronization rules | Connect Sync | Cloud Sync offers an expression builder, not the full rule engine |
| Attribute-based filtering beyond basic needs | Connect Sync | Cloud Sync filtering is limited |
| Merge attributes from several domains into one object | Connect Sync | Not supported in Cloud Sync |
| More than 150,000 objects in a domain, or groups over 50,000 members | Connect Sync | These are the current Cloud Sync limits listed by Microsoft |
Both tools support password hash synchronization, password writeback, Exchange hybrid attributes and device synchronization for hybrid join (in Cloud Sync, device sync is enabled separately). Treat the limits above as values that can change; the principle, that Cloud Sync trades some depth for simplicity and resilience, is what stays stable.
Two architectures
Connect Sync is a server you install and own. The sync engine runs on it, holds the configuration and runs a sync cycle every 30 minutes by default (a delta import, delta sync and export). If that server is down, synchronization stops. A second server can run in staging mode, which imports and synchronizes but suppresses exports, so it can take over when you decide.
Cloud Sync moves the engine into the cloud. A provisioning agent in each environment makes only outbound connections, listens for requests from the Entra provisioning service and answers them from Active Directory. Configuration is stored and edited in the Entra admin center, and the cloud service runs the cycle roughly every two minutes. Install several agents and the loss of one is invisible.
Sync is not sign-in
A frequent trap: choosing the sync tool does not choose how users authenticate. Synchronization puts the identity in Entra ID. The sign-in method is a separate decision:
- Password hash synchronization (PHS) stores a derived hash in the cloud, so Entra ID validates the password itself. It keeps working when the on-premises environment is down.
- Pass-through authentication (PTA) sends the password check to on-premises agents at each sign-in. Choose it when a requirement says passwords must be validated against Active Directory in real time.
- Federation (AD FS) hands sign-in to a federation server you run.
Cloud Sync supports PHS. Pass-through authentication setup is handled separately from Cloud Sync, although Microsoft states that existing PTA and Seamless SSO keep working after a migration. Verify the wording in the question: “sync tool” and “sign-in method” are two different answers.
A worked case: after the acquisition
Contoso, with one forest of 8,000 users, buys Fabrikam, which has its own forest on a separate network with no trust or connectivity to Contoso. Both companies need their users in one Entra tenant within weeks. Contoso already runs Connect Sync on one server.
- Connect Sync cannot reach the Fabrikam forest, and it cannot sync disconnected forests at all, so adding Fabrikam to the existing server is out.
- Install a Cloud Sync provisioning agent inside the Fabrikam network. It only needs outbound access.
- Install a second agent there for failover.
- Configure the Fabrikam sync in the Entra admin center and test one user with on-demand provisioning.
- Leave Contoso on Connect Sync for now, or migrate it later after checking custom rules, filtering and the limits above. The two tools can run side by side for different scopes.
Which exams test this
| Exam | How it appears | Where it is covered here |
|---|---|---|
| SC-300 | Implement and manage user identities (20–25%): implement and manage Connect Sync, Cloud Sync, password hash synchronization, pass-through authentication, seamless SSO and Connect Health, and migrate away from AD FS | User identities |
| SC-900 | Capabilities of Microsoft Entra (25–30%): describe hybrid identity, at concept level; federation appears separately under identity concepts | Microsoft Entra |
| AZ-305 | Design identity, governance, and monitoring solutions (25–30%): recommend an identity management solution. The sync tools are not named in the outline, so this is an indirect, design-level topic | Identity, governance and monitoring |
The SC-300 row follows the English outline that applies from October 28, 2026. The SC-900 row follows the one from October 21, 2026, whose change log lists a minor change in the area that holds the hybrid identity objective.
How exam questions are built around it
The usual pattern is a short scenario with one deciding constraint. “Disconnected”, “no connectivity between forests” and “least administrative effort” point to Cloud Sync. “Custom synchronization rules”, “merge attributes” and “hundreds of thousands of objects” point to Connect Sync. The distractors are often the sign-in methods, so a question that asks how to keep users signing in during an on-premises outage is about PHS, not about the sync tool. Another distractor is AD FS offered as a “modern” choice; the exam treats it as something to migrate away from.
Question 1. A company has three Active Directory forests in separate datacenters with no network connectivity between them. All users must appear in one Microsoft Entra tenant, and the company wants no single server whose failure stops synchronization. What should you deploy?
- A. One Microsoft Entra Connect Sync server with a staging server
- B. Microsoft Entra Cloud Sync with at least two agents in each forest network
- C. Microsoft Entra Connect Sync with AD FS federation
- D. A manual CSV import of users every night
Show answer
Answer: B
Entra Cloud Sync supports disconnected forests natively and lets several provisioning agents run at once with automatic failover. A single Entra Connect Sync server is a single point of failure and cannot synchronize disconnected forests. Staging mode gives a manual standby, not disconnected-forest support. Federation with AD FS is a sign-in method, not a synchronization tool.
Question 2. Your organisation synchronises 400,000 users from one domain and relies on custom synchronization rules that merge attributes from two domains. It wants to keep this setup. Which tool matches the requirement?
- A. Microsoft Entra Cloud Sync
- B. Microsoft Entra Application Proxy
- C. Microsoft Entra Connect Sync
- D. Password hash synchronization on its own
Show answer
Answer: C
Merging attributes from several domains and a custom rule engine are available in Connect Sync, and Connect Sync has no per-domain object limit, whereas Cloud Sync lists a limit of 150,000 objects per domain and does not merge attributes across domains. Cloud Sync suits simple or disconnected topologies. Password hash synchronization is a sign-in feature and does not replace a sync tool. Application Proxy publishes applications and does not synchronize identities.
Go deeper
- What is Microsoft Entra Cloud Sync?
- Cloud Sync migration decision guide, with the feature comparison
- Microsoft Entra Connect Sync: Scheduler
- Next on this site: access reviews and entitlement management for governing the identities you just synchronised, MFA, passwordless and passkeys for what happens at sign-in, and Conditional Access. Exam context in the SC-300 study plan and the SC-300 cheat sheet.