Install and Configure Microsoft Entra Cloud Sync

You want to sync your on-premises Active Directory with Microsoft Entra. But don’t want to keep the software up to date on-premises and want the cloud to do the work. An excellent tool to accomplish this is to use the Microsoft Entra Cloud Sync. In this article, you will learn how to install and configure Microsoft Entra Cloud Sync.

What is Microsoft Entra Cloud Sync

Microsoft Entra Cloud Sync is a lightweight and modern identity synchronization tool designed to enable hybrid identity scenarios. It allows you to sync on-premises Active Directory (AD) users, groups, and contacts to Microsoft Entra ID without the overhead of Microsoft Entra Connect.

This solution is ideal when:

• You have multiple Active Directory forests.
• You want to simplify high availability deployments.
• You need to avoid complex on-prem infrastructure.
• You want faster and more reliable sync with Microsoft Entra ID.

Microsoft Entra Cloud Sync uses a cloud provisioning agent that runs on a Windows Server machine in your on-premises environment. Unlike Microsoft Entra Connect, it offloads most of the sync logic to the cloud, which simplifies management and scaling.

Prerequisites for Microsoft Entra Cloud Sync

Before proceeding, make sure you have:

1. A Microsoft Entra ID tenant.
2. An Entra ID Global Administrator account for initial setup.
3. At least one Windows Server 2016 or later machine (domain-joined) to host the provisioning agent.
4. Necessary firewall ports open: HTTPS (443) and HTTP (80) to Microsoft cloud endpoints.
5. Proper DNS resolution from the server to your domain controllers and to external internet.

Step 1. Download the Cloud Sync Agent

1. Sign in to the Microsoft Entra admin center.
2. Navigate to Identity > Show more

3. Select Hybrid management > Microsoft Entra Connect
4. Click on Cloud Sync

5. Select Agents
6. Click on Download on-premises agent

7. Click on Accept terms & download
8. Save the executable file to your Windows Server machine

Step 2. Install Provisioning Agent on Windows Server

1. Start File Explorer
2. Go to the downloaded Provisioning Agent setup executable file
3. Run the downloaded Microsoft Entra Connect Provisioning Agent installer as Administrator

4. Accept the license terms and conditions
5. Click Install

6. The setup starts installing the Microsoft Entra Provisioning Agent

7. Click Next in the Welcome to the Microsoft Entra provisioning agent configuration wizard screen

8. Select HR-driven provisioning (Workday and SuccessFactors) / Microsoft Entra Cloud Sync
9. Click Next

10. Click Authenticate
11. Sign in with your Microsoft Entra ID administrator credentials

12. Select Create gSMA
13. Enter your On-Premises domain admin credentials
14. Click Next

15. Click Next

16. Click Confirm

17. Click Exit

Step 3. Verify Provisioning Agent status

1. Sign in to the Microsoft Entra admin center
2. Click Agents and verify that the machine name appears and the status is Active

3. Start Windows Services
4. Verify that the Microsoft Azure AD Connect Provisioning Agent service is running

5. Start Active Directory Users and Computers
6. Navigate to Domain (exoip.local) > Managed Service Accounts
7. Verify that the provAgentgMSA service account appears

Step 4. Set up Microsoft Entra Cloud configuration

1. Sign in to Microsoft Entra admin center
2. Click on Configurations
3. Select + New configuration > AD to Microsoft Entra ID sync

4. Select the Active Directory domain
5. Check the checkbox for Enable password hash sync
6. Click Create

7. Click Overview
8. Select Properties
9. Click on the pencil icon to edit the Basics

10. Configure the basics:

• Enable password hash sync
• Enable Exchange hybrid writeback
• Add email address for notifications
• Enable prevent accidental deletion
• Set accidental deletion treshold to 500

11. Select Apply

12. Click Scoping filters
13. Select Selected organizational units
14. Fill in the distinguished name of the on-premises OU that you want to sync with Microsoft Entra ID
15. Click Add
16. Click Save

17. Click Overview
18. Click Review and enable

19. Click Enable configuration

20. Verify that the configuration sync from AD to Microsoft Entra ID shows the status Healthy

Step 5. Enable Password Writeback

Allow password changes in Microsoft Entra ID to sync back to On-Premises AD by following the steps below:

1. Sign in to the Microsoft Entra admin center
2. Go to Protection > Password reset > On-premises integration
3. Turn on:

• Enable password write back for synced users
• Write back passwords with Microsoft Entra Connect cloud sync
• Allow users to unlock accounts with resetting their password

4. Click Save

Step 6. Check Microsoft Entra Cloud Sync logs

1. Sign in to the Microsoft Entra admin center
2. Select Provisioning logs

3. Sign in to your Windows Server
4. Check the logs stored locally on the server where the agent is installed:

C:\ProgramData\Microsoft Entra Connect Provisioning Agent\Logs

That’s it!

Read more: How to check Microsoft Entra Connect version »

Conclusion

You learned how to install and configure Microsoft Entra Cloud Sync. It’s an excellent choice for organizations that want hybrid identity management with minimal overhead. It offers a complete yet lightweight solution for syncing on-premises objects to the cloud.

Did you enjoy this article? You may also like Conditional Access MFA breaks Azure AD Connect synchronization. Don’t forget to follow us and share this article.