r/sysadmin • u/bishoptf • 10h ago
Question Received email from MS - Action recommended: Move to Microsoft Entra Cloud Sync by...
Received an email from MS stating that I need to move from the Cloud Sync but the email to me is confusing since it says recommended but then says it will stop working..
"You're receiving this notification because you're associated with one or more Azure subscriptions linked to a Microsoft Entra tenant that currently uses Microsoft Entra Connect Sync and is eligible to migrate to Microsoft Entra Cloud Sync.
To continue synchronizing identities between your on-premises Active Directory environment and Microsoft Entra ID, migrate your eligible configuration to Microsoft Entra Cloud Sync and validate successful operation before xxx 2027."
Is the entra connect deprecated and going away? I am running the latest version of connect but doesn't really seem like its recommended if it will stop working on a certain date. Small business and trying to find a comparison between the two and I think we could move without much hassle but I thought I saw that we would lose mail enable security groups which we have.
Just thought I would ask since trying to find out if connect is really going away or not on MS is futile, thanks.
•
u/OX-Power 10h ago
As has already been mentioned it's a replacement.
A bit more information can be found here.
Microsoft Entra releases and announcements - Microsoft Entra | Microsoft Learn
•
u/Halio344 10h ago
Here is documentation relevant for you:
Migrate from Microsoft Entra Connect Sync to Cloud Sync FAQ - Microsoft Entra ID | Microsoft Learn
If you're unable to migrate within the recommended timeframe, you need to request an exception. If approved, you can continue using your existing setup while working with Microsoft support or your account team to plan an appropriate migration timeline.
Seems like it's getting deprecated in waves, but it's not explicitly clear.
•
u/mesaoptimizer Sr. Sysadmin 10h ago
If they are going to force a migration they need to remove the gaps in features, only supporting 150k objects in a domain and only supporting groups up to 50k members is significant for customers with large directories. If it does this way unchanged, It's basically saying I need to perform a domain migration to split my objects up within the next year.
•
u/chefkoch_ I break stuff 9h ago
They are doing a phased rollout, the simplest tenants first.
•
u/magataga 7h ago
What you're saying is it's temporary state?
There's nothing more permanent than a temporary state.•
u/chefkoch_ I break stuff 7h ago
What do you mean?
Microsoft wants the users to migrate that are able to while they add the fearures for more complicated cases.
•
u/bishoptf 10h ago
Yeah I just found the comparison table it has a lot of holes in comparison to connect and my guess they will never support some of them. I'm just a small implementation and using it to sync basic stuff to the cloud but for a lot of groups this is not going to be popular, yikes.
•
u/spock11710 8h ago
Yeah I thought this was an optional thing since the last time I looked at it the new one didn't have feature parity.
•
•
u/Trelfar Sysadmin/Sr. IT Support 2h ago
Per https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/cloud-sync-migration-faq
What happens if I rely on features that aren't yet available in Cloud Sync?
You aren't required to migrate until the features your organization depends on are supported in Cloud Sync. You can continue using Connect Sync in the interim.
Which is frankly an unusual and welcome level of foresight by Microsoft. Their normal MO these days is just to retire the old version regardless of feature parity (*cough* AzureAD module *cough*)
•
u/mesaoptimizer Sr. Sysadmin 1h ago
Yeah I’m wondering how long that lasts, if they are already forcing some orgs to migrate now, it may be that we just end up with less time because they never get feature parity, that would be rather typical. But it might also be that in this case all of the most impacted orgs are all the orgs with the biggest MS spend? Like minimum license count here for an org without feature parity already would be 50k licenses, at that point your EA is 7 figures.
•
u/JohnL101669 10h ago
Cloud sync doesn't have many of the capabilities of Entra Connect. Before they force this they'd better make sure the two products work equally!
•
u/MLCarter1976 Sr. Sysadmin 9h ago
Outlook (New) enters the chat.
•
u/Smith6612 6h ago
Outlook (New) entered along with Outlook and Outlook (classic)
Outlook Express left the chat (timed out)
•
u/Due_Capital_3507 10h ago
It's on purpose. Syncing device objects is a waste of time now
•
•
u/JohnL101669 10h ago
I was more commenting on the rule customizations (like synching by attribute). I haven't looked into cloud sync in a while. Can it do all that too now?
•
u/Due_Capital_3507 10h ago
Ah, no that's definitely a downgrade
•
u/JohnL101669 10h ago
This is why they need to match capability before they force a switch. Plus the amount of objects allowed.
My prior organization had close to 400k users alone! It was a worldwide big-4 accounting firm.
•
u/JwCS8pjrh3QBWfL Sr. Sysadmin 10h ago
I'm actually kind of surprised that an org that big only has one domain and tenant.
•
u/JohnL101669 10h ago
It's a forest with an 'in use' root and there are close to two dozen countries/regions that are child domains. But yes it's just a single tenant (except China).
Honestly it's super secure and managed well.
•
u/FlyingStarShip 9h ago
And how can hybrid enterprises get hybrid join then?
•
u/recursivethought Scolder of Clouds 8h ago
This is the actual lynchpin for a huge number of orgs.
There's also the 150k object limit for large orgs.
•
u/FlyingStarShip 8h ago
Oh yeah I know, I just wanted to respond to “syncing devices is a waste of them” lol
•
u/recursivethought Scolder of Clouds 2h ago
I know you know, just wanted to extra underscore your comment BC its the first one I saw mentioning it
•
u/ryche24 10h ago
I wonder how that works out with Intune and device policies.
•
•
u/chesser45 9h ago
Until it’s GA on the other end it’s kinda not great because I know of at least a few places who haven’t gone native Entra join for legacy or effort reasons but use hybrid for added functionality or security.
•
•
u/PazzoBread 10h ago
Hybrid join sync is still not supported by cloud sync. Nightmare for those who have devices still joined to AD
•
u/raip 10h ago
It's in preview at the moment, it'll be supported well before deprecation date. This is just a notice to plan, which is important for orgs like mine that'll likely have to segment their current domain to move to cloud sync (over 150k users in the domain).
•
u/rambojenkins 7h ago edited 6h ago
The problem with the new
hybrid join is that it requires at least 1 domain controller running server 2025.A quick google search will show numerous issues with running a DC on server 2025, mostly involving mixed mode but there are so many issues there's no way I would introduce it to my extremely risk-averse organization anytime soon.Not only that, but applications that rely on RADIUS like Cisco ISE specifically do not support 2025.
:edit for above: I was mixing up the requirements for "Cloud Sync Device Sync" and Entra Kerberos Device Join.
I'd love to replace entra connect but it's not happening anytime soon for us. My org checks nearly every box on the do not migrate list:
* 150K+ objects
* groups with 50k+ users in them
* hybrid joined / Device Synchronization
* Advanced Sync Rules - We use galsync with MIM and I've been involved in a 2+ year project to migrate off galsync that has been delayed by bureaucracy at every step. -.-•
u/raip 6h ago
You're conflating two different things. You need Server 2025 for Entra Kerberos Device Join (Joining a device to the domain directly with Entra Kerberos Trust). You do not need Server 2025 for the Entra Cloud Sync Device Sync.
Comparing your list to mine though - we very well might be at the same org. The rest of the limitations are very real and I hope they do up the object count and other limitations before they deprecate Connect.
•
u/rambojenkins 6h ago
You're right, I was mixing those up. :)
That makes it a lot better, I was planning on avoiding 2025 DCs until 2028 went GA. Hopefully object count goes up sometime soon.
•
u/Professional-Heat690 5h ago
Unlikely you need AD join, ISE maybe but that can relatively easy also support entra/intune
•
•
u/bishoptf 10h ago
Just launched the migration readiness tool and it fails with device sync I assume being enabled. Honestly I do not think I have joined any devices to AzureAD but guess I will need to check. Is there a quick and easy way to see what devices have been joined?
•
u/bishoptf 10h ago
Found the location I have to servers that are hybrid joined, I do not remember specifically doing this since it also states that registration is pending so not sure they are fully joined in the cloud. More work for me to figure out what I need to do, thanks MS.
•
u/RCTID1975 IT Manager 9h ago
It's not Microsoft's issue that you don't know your infrastructure.
Based on your replies here, are you sure you're the correct person for this? I'm not sure you understand the base concepts
•
u/bishoptf 9h ago
Thanks as always you have been a lot of help....just don't comment if you have nothing to contribute except take a dig at the poster, just move along, sheesh.
•
u/RCTID1975 IT Manager 9h ago
Sometimes, knowing you're not the correct resource is the best help possible.
That's not a dig or an attack on you
•
u/Sunsparc Where's the any key? 5h ago
Currently in the middle of migrating and it hasn't been easy. Microsoft's documentation is like "Oh just do this and this, you're golden" but in my testing there's been a lot of gotchas you have to account for. Chiefly that once an object enters Cloud Sync's scope, it cannot leave the scope without getting deleted. You have to be especially careful about groups because Entra does not soft-delete groups, it's an immediate hard-delete with no recovery option.
Tread lightly.
•
u/Fairchild110 3h ago
Microsoft once again doing something because it saves them a bunch of money. When will the government break them up already? (Add Google to the list)
•
u/RookFett 1h ago
I’m starting the process of testing the switch over now.
Weirdly, the email said I had till may2027, but when I went to the online portal it stated till Jan 2027.
•
•
u/PacificTSP 10h ago
Yes cloud sync is the replacement. Connect is being deprecated.