Should you migrate from Azure AD to Cloud Sync?

Even though a lot of the functionality of domain controllers can be moved to the cloud, most organizations using Active Directory require a hybrid infrastructure that allows users to access Azure Active Directory as well as cloud resources (such as OneDrive and Microsoft 365) provides access. On-premises file shares, printers, and applications that still require local credentials.

Over the years, Microsoft has had a number of tools for managing hybrid identities and syncing cloud and on-premises users and groups.

Look: Explore TechRepublic’s hybrid cloud cheat sheet.

Microsoft Identity Manager, which replaced Forefront Identity Manager, is supported until January 9, 2029, but its Azure AD connector is deprecated. Azure AD Multi-Factor Authentication Server has also been deprecated and will stop handling MFA requests after September 30, 2024. If you’re still using these devices, you’ll need to move to a newer option.

jump to:

Azure AD Connect and its limitations

Azure AD Connect replaced the older DirSync and Azure AD Sync options for syncing users, groups, and other directory objects to Azure AD. It supports:

• password hash synchronization, Syncing the hashes of each user’s AD passwords to Azure AD.
• pass-through authentication, Sending users to Azure AD to sign in and then validating against AD so they can use the same password for resources in the cloud and on-premises without the need to set up federation.
• Active Directory Federation Services Use.

But, Azure AD Connect requires setting up and maintaining a server on your network, and some of the requirements to get it running don’t work for every organization, especially if you have multiple AD “forests” running on Azure. Makes working with AD complicated.

“To use it, you need to be in a connected forest; You need to set up a database,” said Joseph Dadzi, a director of the Microsoft Identity team. “It’s expensive to manage and deploy.

“We’ve started getting a lot of feedback from customers around the cost of deploying AD Connect Sync and the cost of maintaining it, and if you’re in a disconnected wilderness or you’re in an organization where you’re going to be doing an M&A There are some feature gaps when we’re trying to do that. So, we’re open to finding ways to make it simpler.”

Cloud Sync aims to replace Azure AD Connect for the cloud

The result is Azure AD Connect Cloud Sync, which began as a tool to bring identities from multiple disconnected AD forests into a single Azure AD tenant.

It still does this, but now it’s a lightweight alternative to AD Connect that doesn’t have as many features but is much faster to set up and requires fewer resources. This is because Cloud Sync moves most of the configuration to the cloud, requiring only provisioning agents.

“When you look at AD Connect, almost all of the configuration is done in the on-premises world, and it’s stored in that local server,” Dadzi said. “For cloud sync, the key is to switch the configuration to be cloud based and have a very lightweight agent in the customer’s environment so that it is easy to deploy.

“It takes up about 10 megabytes, so you can have several of these working together for high availability solutions; This is more difficult to do if you have full connect sync capability.

This high availability is especially useful if you are using Microsoft’s recommended password hash synchronization.

future of cloud sync

Cloud Sync can handle groups of up to 50,000 members, but it doesn’t include everything you can do with AD Connect Sync, Dadzee told us.

“If you’ve done a lot of customization on features in your AD and you still use Exchange on-premises, there’s still some delta in the capabilities,” Dadzi said. “In the long term, we want it to be a full replacement; We are not there yet.”

Currently, it cannot connect to LDAP directories and does not yet have support for device objects, only users, groups and contacts. Advanced customization and filtering options aren’t available, and Cloud Sync can’t handle Exchange hybrid writeback, so you can’t use it for Exchange hybrid migration.

Federation is supported but not Azure AD Domain Services or Pass Through Authentication, at least for disconnected forests. That’s something the AD Connect team is working on, Dadzee said, and writeback for security groups is also in development.

“Over the past year, we added self-service password writeback scenarios,” said Dadzee.

Device writeback is also under development, because “almost any deployment starts with moving some users from the on-premises to the cloud,” Dadzi notes. It’s a bit confusing because both Azure AS and Windows Hello for Business have services called Cloud Kerberos Trust, which work differently, but Microsoft tells us that the naming and documentation should become clearer in the future.

The Cloud Sync team is also looking into writeback options.

“If you have an on-premises app and you have a cloud user that needs access to it, how do you allow that user to not have an account in the on-premises AD,” Dadzy said. “We’re looking at what we can do in that space: Is there a way some of the secrets can go down so that you can have user credentials where the user has access to the on-premises object without the user being there ?”

It’s still in its early stages, but there are regular updates to the cloud sync functionality.

“Every quarter to six months, we update and add new capabilities,” Dadji said. “We are on a mission to remove the reasons why anyone would still want to use full AD Connect sync. We’re on a mission to keep adding cloud sync to the point that we eventually replace AD ​​Connect sync, but we’re not there yet.

Choosing between Azure AD Connect and Cloud Sync

There’s no immediate need to move to cloud sync if you need the AD Connect sync feature, but there are some scenarios where cloud sync is already a better choice, as well as less demanding.

“It works well for organizations that aren’t as complex or that don’t have a lot of objects; If they have less than 150K items in their directory, it’s easy to start using Cloud Sync,” said Dadzee.

There’s a wizard in the Microsoft 365 admin center that walks you through choosing the right identity sync options as well as a step-by-step migration guide if you want to move from Azure AD Connect sync to cloud sync.

How complex the migration will be depends on how complex your AD environment is: “The more complex the environment, the more a phased approach works,” Dazy said. But if your needs are less complex and you’re just getting started with hybrid identity, he suggests starting with Cloud Sync for simplicity’s sake (Figure A,

Figure A

In fact, a big part of Cloud Sync’s appeal is that it’s designed to be very easy to get started.

“In Connect Sync, you have to do all the schema mapping yourself, whereas in Cloud Sync we try to autodiscover them for you, so you don’t have to hunt around and make it easy for you to configure them,” Dadzy said. “The main principle that we’re trying to get across with Cloud Sync is to make it super, super easy, so that customers don’t have to think about these things.”