ExamFinch.com My Study

Study guide

8.2 Directory Sync with Entra Connect Sync & Cloud Sync

Practice this exam

Microsoft 365 Administrator Expert MS-102

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide

2 Tenant Setup, Domains & Org Settings

2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile

3 Service Health, Network & Software Updates

3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates

4 Adoption, Usage & Microsoft 365 Backup

4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup

5 Users, Contacts, Groups & Shared Mailboxes

5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes

6 Licensing & Bulk User Management

6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell

7 Roles, Admin Units & Privileged Identity Management

7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM

8 Identity Synchronization with Entra Connect

8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization

9 Authentication, SSPR & Password Protection

9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues

10 Identity Protection, Conditional Access & MFA

10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access

11 Defender XDR Posture, Incidents & Threat Intelligence

11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence

12 Defender for Office 365: Policies, Alerts & Investigation

12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats

13 Attack Simulation & Restricted Entities

13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users

14 Defender for Endpoint

14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard

15 Defender for Cloud Apps

15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery

16 Purview Information Protection & Data Lifecycle

16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer

17 Purview Data Loss Prevention

17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports

18 Final Review & Exam Strategy

18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps

8.2 Directory Sync with Entra Connect Sync & Cloud Sync

Key Takeaways Explain This Topic AI

Microsoft Entra Connect Sync is the traditional on-prem sync server with metaverse, connector spaces, and the Synchronization Service Manager

Microsoft Entra Cloud Sync is the newer, lighter, agent-based engine that runs sync logic in the cloud and supports multi-agent high availability

Cloud Sync is Microsoft's recommended path for new deployments and lightweight scenarios; Connect Sync is required for AD FS federation, device sync, and several write-back features

Both engines support password hash sync, pass-through authentication, and exchange hybrid; filtering can be domain, OU, or group-based

Choosing the right engine up front avoids a costly migration later because the two engines cannot run full sync against the same tenant simultaneously

Last updated: August 2026

Directory Sync with Entra Connect Sync & Cloud Sync

Quick Answer: Microsoft ships two sync engines. Entra Connect Sync is the established on-premises server with the metaverse and Synchronization Service Manager. Entra Cloud Sync is the newer, lightweight provisioning-agent model that runs sync logic in the cloud. For new deployments without federation, Cloud Sync is Microsoft's recommended path; Connect Sync is required for AD FS federation, device sync, and several write-back features.

Entra Connect Sync (the traditional engine)

Microsoft Entra Connect Sync installs on a dedicated Windows Server you domain-join. Its architecture has three layers:

Connector spaces — staged copies of objects from each connected directory (one for on-prem AD, one for Entra ID)

The metaverse — the in-memory join of all connector spaces; the canonical object once duplicates are joined

Synchronization rules — direction-aware rules that flow attributes inbound and outbound, with precedence resolving conflicts

You operate it with the Synchronization Service Manager ( miisclient.exe ), where you run import/sync/export profiles, inspect connectors, and trace object flow. A built-in scheduler runs a delta sync every 30 minutes by default; you can force a full or delta cycle manually.

Key features only Connect Sync offers today include AD FS federation configuration , device sync (Hybrid Azure AD Join write-back) , password writeback , group writeback , and exchange hybrid with write-back of on-prem attributes . Custom sync-rule scenarios — where you author your own inbound/outbound rules with precedence — are a Connect Sync specialty.

Entra Cloud Sync (the newer, lighter engine)

Microsoft Entra Cloud Sync moves the sync logic into Microsoft's cloud. You install one or more lightweight Microsoft Entra provisioning agents on-prem; the agents read from AD over LDAP and relay changes to the cloud sync service, which writes to Entra ID. There is no on-prem metaverse to maintain.

Cloud Sync advantages:

Multi-agent high availability — install up to four agents per domain; the cloud service load-balances across them and fails over automatically

Large-environment scale — Microsoft documents Cloud Sync as better suited to large or scaled environments where a single Connect Sync server becomes a bottleneck

Simpler upgrades — sync logic lives in the cloud, so Microsoft rolls out fixes without an on-prem server upgrade

Lighter footprint — no SQL Express instance, no metaverse database, no sync-server OS to patch in the same way

Cloud Sync is Microsoft's recommended path for new deployments that do not need federation or the write-back features exclusive to Connect Sync.

Choosing Between the Two

  • Capability Connect Sync Cloud Sync
  • Agent-based, cloud-run sync logic No Yes
  • Multi-agent high availability No (single primary, optional staging) Yes (up to 4 agents per domain)
  • AD FS federation wizard Yes No
  • Password Hash Sync / PTA Yes Yes
  • Password writeback Yes No
  • Device sync / Hybrid Azure AD Join write-back Yes No
  • Group writeback Yes No
  • Exchange hybrid write-back Yes Limited
  • Custom sync rules with precedence Yes (advanced editor) Limited (attribute mapping)
  • Filtering: domain / OU / group Yes Yes
  • Recommended for new deployments When federation or write-back is required Yes, for non-federated scenarios

The two engines cannot run full directory sync against the same tenant simultaneously — pick one per tenant and plan migration if you ever need to switch.

Sign-in Method Configuration

Both engines let you choose a sign-in method during install:

Password Hash Sync (PHS) — hashes of on-prem passwords are synchronized to Entra ID; users sign in against Entra with the same password. Simplest, no on-prem dependency at sign-in time.

Pass-Through Authentication (PTA) — an on-prem agent validates the password directly against AD at sign-in. No password hash leaves the perimeter. Requires PTA agents for availability.

Federation (AD FS) — Connect Sync only. The STS issues tokens; Entra trusts it. Choose for smartcard/HAADJ, on-prem MFA, or claims-based apps.

Filtering

Filtering controls which on-prem objects reach the cloud. Both engines support:

  • Domain-based filtering — include or exclude whole domains
  • OU-based filtering — include or exclude specific OUs; the most common scoping method
  • Group-based filtering — synchronize only members of a pilot group (useful for staged rollouts)

In Connect Sync, filtering is configured in the wizard and stored in sync rules. In Cloud Sync, filtering is configured as scoping filters on the provisioning configuration in the Entra admin center.

Attribute Mapping and Exchange Hybrid

Both engines map on-prem AD attributes to Entra ID attributes. Default mappings cover the common attributes ( givenName , surname , displayName , mail , userPrincipalName , proxyAddresses ). You can extend mapping for custom attributes — in Connect Sync via the sync rule editor, in Cloud Sync via the attribute-mapping UI.

For Exchange hybrid , Connect Sync writes back on-prem attributes such as msExchArchiveGUID and msExchSafeSendersHash so on-prem Exchange and Exchange Online coexist. Cloud Sync has limited exchange hybrid support — verify the specific write-back attributes you need before choosing.