Abdalla Elmorsi

Dec 14, 2025
Microsoft

Install and Configure Microsoft Entra Cloud Sync

5 min readBeginner
by AbdallaElmorsi

Microsoft Entra Cloud Sync is a lightweight identity synchronization tool that moves users, groups, and contacts from on-premises Active Directory to Microsoft Entra ID. Unlike the full Entra Connect sync engine, most of the logic runs in the cloud while a small provisioning agent runs on one or more domain-joined Windows Servers. That makes it attractive for multi-forest environments and for organizations that want to avoid a heavyweight on-premises installation. In this guide you will learn how to install and configure Microsoft Entra Cloud Sync, including enabling password writeback and checking the logs.

What is Microsoft Entra Cloud Sync

Cloud Sync is built around a cloud provisioning agent. The agent runs on a Windows Server in your on-premises environment and communicates with the cloud service, which holds the sync configuration. You manage everything from the Microsoft Entra admin center instead of a local wizard.

It is a good fit when you have multiple Active Directory forests, when you want simplified high availability, or when you prefer not to maintain complex on-premises infrastructure. The agent itself is easy to install and upgrade, and the cloud service does most of the heavy lifting.

Requirement Details
Tenant An active Microsoft Entra ID tenant
Administrator Entra ID Global Administrator for the initial setup
Agent host At least one domain-joined Windows Server 2016 or later
Network Outbound HTTPS (443) and HTTP (80) to Microsoft endpoints; DNS resolution to domain controllers

Install Microsoft Entra Cloud Sync

1
Download the provisioning agent

In the Microsoft Entra admin center, go to Identity > Hybrid management > Microsoft Entra Connect, open Cloud Sync, and select Agents. Choose Download on-premises agent, accept the terms, and save the installer to the Windows Server that will host the agent.
Screenshot of the Agents page in the Microsoft Entra admin center with the Download on-premises agent button highlighted
2
Install the provisioning agent

Run the setup executable as Administrator, accept the license terms, and install. When the configuration wizard starts, select the provisioning option that matches your goal — HR-driven provisioning or Microsoft Entra Cloud Sync — and click Next.
3
Authenticate and register the agent

Click Authenticate and sign in with a Global Administrator account. The wizard then creates the group managed service account (gMSA) that the agent runs as, and asks for the on-premises domain administrator credentials used to register the agent with the domain.
Screenshot of the provisioning agent configuration wizard asking to authenticate with Entra ID administrator credentials
4
Verify the agent status

Back in the Microsoft Entra admin center on the Cloud Sync Agents page, confirm the agent appears and reports a healthy status before you configure the sync itself.
Screenshot of the Cloud Sync Agents page showing the newly registered agent with a healthy status

Configure Microsoft Entra Cloud Sync

1
Create the cloud sync configuration

On the Cloud Sync page, create a new configuration. Name it, attach the agent you installed, and choose which organizational units and groups to sync.
2
Map attributes and review scoping

Review the attribute mapping so the right on-premises properties flow to the right Entra ID attributes. Confirm the scoping filters include the OUs you want and exclude everything else.
3
Enable password writeback

If you want password changes from the cloud to flow back to on-premises Active Directory, enable password writeback in the configuration. This lets users self-service reset their on-premises passwords from the cloud.
Screenshot of the password writeback toggle enabled in the Cloud Sync configuration
4
Check the sync logs

After provisioning starts, review the sync logs in the admin center to confirm objects are syncing and to troubleshoot any skipped objects.
Screenshot of the Cloud Sync provisioning logs showing successful user sync entries

Frequently asked questions

How is Microsoft Entra Cloud Sync different from Microsoft Entra Connect?

Cloud Sync moves most of the sync logic to the cloud and runs only a small agent on-premises, which makes it lighter and easier to scale across multiple forests. Entra Connect runs the full sync engine on a Windows Server.

Which Windows Server versions can host the provisioning agent?

The agent runs on domain-joined Windows Server 2016 or later, including Server Core installations.

Does Cloud Sync support password writeback?

Yes. Password writeback can be enabled in the configuration so cloud password changes are written back to the on-premises directory.

Can I run multiple provisioning agents?

Yes. You can install several agents for high availability, and the cloud service distributes the provisioning work across them.

Where do I monitor the sync status?

In the Microsoft Entra admin center under the Cloud Sync configuration, where you can review the health of the agents and browse the provisioning logs.

Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *

You may also like