When an organization already has Microsoft 365 accounts and wants to synchronize an existing Active Directory, the central question is not only which agent to deploy. It is which on-premises identity should match which existing cloud account.

1. Map each identity first

Build a table covering on-premises UPN, verified cloud domains, primary SMTP and existing Microsoft 365 identities. Old suffixes, aliases and duplicate values can cause provisioning conflicts.

Check UPN alignment with verified domains
Review uniqueness of email attributes
List cloud-only and privileged identities

2. Soft match and hard match are different

Soft matching uses identity attributes such as UPN or primary SMTP; hard matching relies on a source anchor. Do not mass-change immutable identifiers without understanding existing object mappings. Previously linked accounts and privileged roles need additional review.

3. Select a supported synchronization approach

Entra Cloud Sync uses a lightweight agent and cloud-managed provisioning. Entra Connect Sync has a different feature scope. Review device scenarios, attribute mapping and other dependencies against Microsoft’s current comparison before choosing.

Scope the pilot to a small applicable OU or group
Test with a nonprivileged account
Review provisioning logs before expansion

4. Protect administrative accounts

Privileged cloud accounts are not ordinary synchronization targets. Review Microsoft’s current safeguards and hard-match limitations before applying changes to accounts holding administrative roles.

5. Monitor beyond the initial test

After enabling synchronization, watch for attribute changes, failed provisioning and conflicts involving renamed or newly created users. A successful pilot is an essential checkpoint, not a permanent guarantee.

VALUE360 approaches hybrid identity as an identity governance and risk-management project, not simply a synchronization-agent installation.

Explore the related VALUE360 service →

Technical references

Microsoft 365 environment review

Inventory Entra ID policies, user and application permissions, audit logs and exceptions. Pilot changes with a limited group, validate access impact and define a rollback path.

Implementation questions

Does this automatically affect our environment?

No. First verify whether the specific product, version and relevant configuration are deployed.

Is a security tool enough on its own?

No. Combine patching, restricted access, logging and tested backups.

Microsoft Entra Cloud Sync: matching identities without duplicate accounts