Microsoft’s October Entra blog announces general availability of a guided tool for moving from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync. For businesses with 10 to 250 employees and on-premises Active Directory, this provides a practical reason to review synchronization. Eligibility depends on the configuration, not headcount. The tool supports specific environments and does not replace operational acceptance. A matching aggregate object count, for example, does not establish that group memberships and password writeback work as intended. The immediate task is to assess readiness, not to start an unplanned migration.
What the guided tool handles
The wizard assesses the environment, transfers supported settings, and sets up the provisioning agent and Cloud Sync configurations. A Provision on Demand check follows before activation. During transfer, the new configurations remain disabled and Connect Sync continues exporting. Only activation enables Cloud Sync and places Connect Sync into staging mode. The existing installation remains available for subsequent validation. When operating Microsoft Entra ID, this controlled handover matters more than finishing the wizard quickly. Administrators should understand which system is exporting at each stage before approving the transition.
Which environments currently qualify
Microsoft distinguishes general Cloud Sync capabilities from the migration tool’s narrower limits. These limits must not be presented as universal product limits. The current tool documentation specifies the following prerequisites and exclusions:
- One Active Directory forest with no more than 2,000 objects in the intended synchronization scope.
- Additive organizational-unit inclusion scoping with no more than 30 included containers per domain.
- No blocking features such as custom synchronization rules, group filtering, a custom UPN, directory extensions, or device synchronization.
- A supported Connect Sync version and eligibility for the current migration wave; launch the tool on the active server, not a staging server.
Supported scenarios include user and group synchronization, password hash synchronization, password writeback, and Exchange hybrid writeback. The readiness assessment must confirm whether the combination in your environment qualifies. Microsoft explicitly says not to bypass a blocking result. A small business may therefore remain ineligible. Conversely, a higher employee count does not itself prevent migration if the documented technical requirements are satisfied. Record configuration dependencies rather than treating company size as a shortcut for readiness.
Deadlines: check your notification, not a universal date
The October blog does not state a universal Connect Sync retirement date. Microsoft’s Entra announcements describe a phased transition with individual windows and notifications through Message Center, Connect Health, and email. Check your own tenant’s notice instead of copying a deadline from another organization. For confirmed technical or business blockers, the tool guide describes requesting a temporary migration exception through Microsoft Support. Requests are reviewed individually and approval is not guaranteed. General availability alone does not establish a specific migration day for your tenant without its notification.
What still needs verification after activation
The automatic validation compares one aggregate Total Objects count, checks required Cloud Sync jobs, and confirms Connect Sync staging mode. It does not automatically validate individual users, groups, memberships, or writeback operations. Representative manual checks are explicitly required. Before activation, read the detailed Provision on Demand results for every migrated domain configuration rather than relying on its final success indicator. If password writeback is enabled, also verify tenant-level SSPR writeback. Microsoft requires a two-week validation period with Connect Sync still installed. Removing it immediately would therefore be premature, even when the initial object counts match.
Practical next steps for hybrid small businesses
We recommend a documented readiness review followed by an approved change window. This sequence is a ReByteIT working recommendation, not an additional Microsoft deadline. Technical planning can form part of Microsoft 365 consulting; it does not include licensing recommendations.
- Inventory the forest, domains, object scope, filters, custom rules, and enabled writeback features.
- Check tenant notifications, retain the readiness report, and resolve blockers before proceeding.
- Assign responsible administrators with the Hybrid Identity Administrator role and required domain permissions; keep credentials out of project records.
- Choose approved test objects for each domain and evaluate Provision on Demand details before activation.
- After activation, document individual objects, memberships, writeback, and job health; keep Connect Sync installed throughout the two-week validation.
Official Microsoft sources
- Microsoft Entra Blog: October 2026, guided Cloud Sync migration generally available
- Microsoft Learn: migration tool, limits, and validation
- Microsoft Learn: phased transition and individual notifications
Our Microsoft Security Assessment examines technical identity configuration and verifiable results. The aim is an evidence-based decision about the next step, not migration simply because a new tool is available.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
