Microsoft's October 2026 Entra update lists the guided migration from Connect Sync to Cloud Sync as generally available. The announcement brings readiness assessment, configuration transfer, controlled activation, and validation into one workflow for eligible organizations. Microsoft's October roundup.
For hybrid identity teams, the useful next step is an eligibility and validation review. A simpler wizard should make the migration easier to organize, but the acceptance decision still needs evidence about the identities and access relationships the organization relies on.
General Availability Still Has a Supported Scope
The current tool documentation limits the guided path to one forest, at most 2,000 in-scope objects, and at most 30 included OU containers per domain. It also lists migration blockers, including custom sync rules, group filtering, directory extensions, device synchronization, and unsupported writeback scenarios. The option appears only for eligible installations in the current migration wave. Tool prerequisites.
I would capture the current configuration and compare it with that supported scope before scheduling a change. Record the outcome as eligible, blocked, or requiring further investigation, with an owner for every unresolved item.
Do not interpret a limitation of this migration tool as a statement about every Cloud Sync capability. The proposed change should be evaluated against the exact path the team plans to use.
Build the Acceptance Sample Before Activation
My recommendation is to prepare a small, named set of approved test identities and relationships. Include a typical user, a group used for access, and any enabled writeback workflow that is important to the organization.
For each sample, record the expected outcome and who can confirm it. An identity engineer may verify the directory state, while an application owner confirms the access experience that depends on it.
Use test identities and approved records wherever possible. A migration evidence pack should not become a broad export of employee information or a place to store privileged credentials.
I would also identify the failure that would stop the rollout. Examples include an unexplained membership difference or a critical application access check failing after the transition.
Understand the Activation Boundary
Microsoft documents a preactivation Provision on Demand check. Activation then enables Cloud Sync and places Connect Sync in staging mode. The validation page checks aggregate object counts, job health, and staging state; it does not automatically validate individual users, groups, memberships, or writeback operations. Keep Connect Sync installed for the documented two-week validation period. Activation and validation behavior.
That distinction is the center of my review: make the aggregate comparison one input to acceptance, then inspect the representative objects and workflows selected beforehand.
Keep unresolved differences visible. Assign an owner and a next check instead of recording the change as successful while an important access scenario remains unexplained.
Preserve a Recoverable Change Record
Microsoft's migration FAQ recommends backing up the Connect configuration and describes retaining a rollback option while validating Cloud Sync. Migration FAQ.
I would put the backup location, approved recovery procedure, escalation contacts, and validation evidence in the same change record. Have a second engineer review whether that record is sufficient to take over the work during an incident.
Microsoft warns that manually changing migration-owned resources can interfere with recovery. Use the tool's recovery instructions for activation problems. Troubleshooting guidance.
Plan the Operational Handoff
My proposed handoff would state who reviews provisioning failures, who receives notifications, and how an application team reports an unexpected access change during validation.
Agree on a review cadence and the evidence needed to close the migration. Keep the next action clear when a check is inconclusive, particularly if several teams depend on the same directory relationships.
Use the organization's actual notification and support guidance for any migration window. This announcement alone is not evidence of one universal deadline for every tenant.
Practical Cloud Engineer Takeaway
Check the guided tool's current eligibility rules against the real configuration.
Define representative object and access checks before the transition.
Treat aggregate counts as evidence, not the entire acceptance decision.
Retain the documented validation and recovery path.
Give every unresolved difference a named owner.
Who Should Care?
Hybrid identity administrators, Azure platform teams, and application owners whose access depends on synchronized users and groups.
Bottom Line
Use the GA tool to organize a supported transition. Close the change only when the team can explain the resulting directory state and demonstrate the agreed access scenarios.
These are planning recommendations, not a report of a migration performed for this article.
Sources
Stay radical, stay curious, and keep pushing the boundaries of what is possible in the cloud.
Chriz
Beyond Cloud with Chriz
Comments