How to move from on-premises Active Directory to Microsoft Entra ID

Count users, groups, contacts, service accounts and computers per domain and forest. Run the commands once per domain, adding -Server contoso.com to each command for other domains. Note large groups: Cloud Sync supports groups up to 50,000 members, Connect Sync supports larger ones. Record the counts and the largest groups in the mapping sheet.

Get-ADForest | Select-Object -ExpandProperty Domains
(Get-ADUser -Filter *).Count
(Get-ADGroup -Filter *).Count
(Get-ADComputer -Filter *).Count
(Get-ADObject -Filter 'objectClass -eq "contact"').Count
Get-ADGroup -Filter * -Properties member | Select-Object Name, @{n='Members';e={$_.member.Count}} | Sort-Object Members -Descending | Select-Object -First 20

Add one row per app with columns for app name, owner, server, sign-in method (LDAP bind, Kerberos, NTLM, AD FS or other) and number of users. Microsoft says users can't move to cloud SOA if they still use apps needing password-based LDAP bind or Kerberos with a password, so mark those rows clearly.

List domain-joined PCs and servers by operating system, and list every Group Policy object. Add your imaging tools to the sheet. Hybrid join is the right fit only if you still need Group Policy, existing imaging or Win32 apps that rely on AD machine authentication.

Get-ADComputer -Filter * -Properties OperatingSystem | Group-Object OperatingSystem | Select-Object Count, Name
Get-GPO -All | Select-Object DisplayName, GpoStatus, ModificationTime

If you run AD FS, list relying parties and back up the Microsoft 365 relying party trust and its claims rules, as Microsoft recommends before changing sign-in. If you use a third-party IdP, export its list of connected apps from its own admin console. These need a plan before you change sign-in.

Get-AdfsRelyingPartyTrust | Select-Object Name, Enabled, Identifier
(Get-AdfsRelyingPartyTrust -Name "Microsoft Office 365 Identity Platform") | Export-CliXML "C:\temp\O365-RelyingPartyTrust.xml"

Check the scheduler settings, then start a delta sync to confirm sync works. The default cycle is every 30 minutes. If you have no sync server yet and Connect Sync is the right choice, install Microsoft Entra Connect Sync first.

Get-ADSyncScheduler
Start-ADSyncSyncCycle -PolicyType Delta

Disable the scheduler while you change configuration, and turn it back on afterwards. Microsoft says a sync cycle must run at least once every 7 days.

Set-ADSyncScheduler -SyncCycleEnabled $false
# make changes
Set-ADSyncScheduler -SyncCycleEnabled $true

Cloud Sync uses a lightweight provisioning agent with outbound-only connections. Sign in as at least a Hybrid Identity Administrator. Select Download on-premises agent, then Accept terms & download.

Run AADConnectProvisioningAgentSetup.exe. Tick I agree to the license terms and conditions and select Install. On Welcome select Next. On Connect Microsoft Entra ID sign in as a Hybrid Identity Administrator. On Configure Service Account choose Create gMSA (enter domain administrator credentials) or Use custom gMSA. On Connect Active Directory add your domain with Add directory if it is not listed, then select Next, Next and Confirm. The agent does not sync anything until you create a Cloud Sync configuration.

Repeat the install on another server: deploy more than one agent for failover. Microsoft's guided migration tool currently lists device synchronisation as a migration blocker, so check it if you use hybrid join before moving off Connect Sync.

Microsoft recommends enabling PHS with whichever method you choose. Entra ID Protection needs PHS for the leaked credentials report, and PHS is the fallback if PTA or AD FS fail. Failover is manual, through Entra Connect. Tick Password hash synchronization on Optional features, finish the wizard with Configure, and let a full password hash sync run.

If you federate today, Microsoft recommends testing cloud authentication with staged rollout for a pilot group. Use a cloud security group (nested and dynamic groups are not supported) with 200 members or fewer when you first add it. Select Enable staged rollout for managed user sign-in, slide Password Hash Sync to On (optionally Seamless single sign-on too) and add the pilot group. You can add up to 10 groups per feature. Reconfigure SaaS apps federated with AD FS to authenticate with Entra ID (see Step 5).

Record the current federation settings for each domain before you convert it. Microsoft says to review PreferredAuthenticationProtocol, federatedIdpMfaBehavior, SupportsMfa and PromptLoginBehavior for customisations. Save the output with your rollback plan.

Connect-MgGraph -Scopes "Domain.ReadWrite.All","Directory.AccessAsUser.All"
Get-MgDomainFederationConfiguration -DomainId contoso.com | Format-List

Convert each domain. Microsoft says conversion may take up to 60 minutes and you do not have to convert all domains at once, so start with a test domain or the one with fewest users. Schedule it out of business hours. If Entra Connect originally configured your AD FS farm, Microsoft also documents doing this in the wizard under Configure > Change user sign-in > Password hash synchronization.

Update-MgDomain -DomainId contoso.com -AuthenticationType "Managed"
Get-MgDomain -DomainId contoso.com

Microsoft says Entra join should be the default for new and reset endpoints, and hybrid join for new endpoints is typically not recommended. At scale, register devices with Windows Autopilot (export the Autopilot hardware hash) and assign a deployment profile that uses Microsoft Entra join. For a single pilot PC, select Connect, then Join this device to Microsoft Entra ID and sign in as the user.

dsregcmd /status

Microsoft states there is no supported path to convert a hybrid joined device to Entra joined without a Windows reset. Add a target reset or replacement date to each hybrid joined device in your inventory, and reset or replace devices on their normal refresh cycle.

Hybrid joined devices need periodic network line of sight to domain controllers. Without it they become unusable. Keep VPN or other connectivity in place until each device has been reset to Entra join.

dsregcmd /status

Microsoft says Entra joined devices can access on-premises resources with single sign-on. Open a file share by path (for example \\fs01\Shares\Finance) and add a network printer. Test with a pilot group before scaling.

Search the gallery for the app, add it, open Single sign-on and choose SAML or OpenID Connect as the app supports, then assign a pilot group. Once users sign in through Entra ID, remove the AD FS relying party. Microsoft suggests confirming with Microsoft Entra Connect Health that no new AD FS requests arrive before removing the Microsoft 365 trust.

Remove-AdfsRelyingPartyTrust -TargetName "App name"

For apps that still need Kerberos, Microsoft points to passwordless sign-in with Windows Hello for Business and Cloud Kerberos Trust. With Cloud Sync provisioning to AD, Entra ID can remain the source of authority while an AD account is maintained.

For each app flagged for LDAP, record the LDAP server and bind account from its settings. Replace or modernise apps that use password-based LDAP bind before transferring those users' source of authority.

Microsoft lists: Connect Sync 2.5.76.0 or later, or Cloud Sync provisioning agent 1.1.1370.0 or later; Hybrid Administrator role; Entra Free licence; no on-premises Exchange workloads; no AD FS federated authentication for the users; and no apps needing password-based LDAP bind or Kerberos with a password. Read the version number and upgrade if it is lower.

Connect with the documented permission and accept the consent prompt. Microsoft also documents granting it in Graph Explorer under Consent to permissions.

Connect-MgGraph -Scopes "User-OnPremisesSyncBehavior.ReadWrite.All"
Get-MgContext | Select-Object -ExpandProperty Scopes

Read the user's current setting. In the admin center, open the user: synced users have read-only fields and show the source as Windows Server AD DS.

Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/users/user@contoso.com/onPremisesSyncBehavior?`$select=isCloudManaged"

Set isCloudManaged to true and read it back. Confirm the "Change Source of Authority from AD to cloud" entry in the audit log, then confirm the user can be edited in the cloud.

Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/users/user@contoso.com/onPremisesSyncBehavior" -Body '{"isCloudManaged": true}' -ContentType "application/json"
Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/users/user@contoso.com/onPremisesSyncBehavior?`$select=isCloudManaged"

Transferred users keep attributes such as onPremisesSamAccountName and onPremisesSecurityIdentifier. Microsoft says you maintain them through Graph if users still need on-premises access. Do not delete them if users still need on-premises resource access.

Microsoft documents a rollback: remove the user from SOA-transferred groups and access packages, set isCloudManaged to false, and run a sync cycle. Microsoft's steps also turn off the blockCloudObjectTakeoverThroughHardMatchEnabled feature flag first and turn it back on afterwards; follow the Configure user Source of Authority page for that call. The rollback is not complete until the next sync finishes.

Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/users/user@contoso.com/onPremisesSyncBehavior" -Body '{"isCloudManaged": false}' -ContentType "application/json"
# on the Connect Sync server
Start-ADSyncSyncCycle -PolicyType Delta

Microsoft advises uninstalling Connect Sync or Cloud Sync first if the goal is permanent, otherwise the portal may show optional features such as PHS as still enabled. Select the Microsoft Entra Connect entry (or the provisioning agent) and choose Uninstall.

Run the commands below. Read the 72-hour warning first.

Install-Module Microsoft.Graph -Force
Connect-MgGraph -Scopes "Organization.ReadWrite.All,Directory.ReadWrite.All"
$organizationId = (Get-MgOrganization).Id
$params = @{ onPremisesSyncEnabled = $false }
Update-MgOrganization -OrganizationId $organizationId -BodyParameter $params
Get-MgOrganization | Select OnPremisesSyncEnabled

Review domain controller security logs for remaining logons from users, services and devices. Filter for logon event 4624 and note any account or computer that is not the DC itself.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 200 | Select-Object TimeCreated, Message

Remove AD FS and WAP servers, sync servers, then demote domain controllers once no device or app needs them. Demote the last domain controller only after the backup in the next step.

Uninstall-ADDSDomainController

Take and retain a system state backup of a domain controller in line with your records policy.

wbadmin start systemstatebackup -backupTarget:E: