|
| 1 | +--- |
| 2 | +title: 'Migrate Azure AD Connect to Azure AD Connect cloud sync| Microsoft Docs' |
| 3 | +description: Describes steps to migrate Azure AD Connect to Azure AD Connect cloud sync. |
| 4 | +services: active-directory |
| 5 | +author: billmath |
| 6 | +manager: amycolannino |
| 7 | +ms.service: active-directory |
| 8 | +ms.workload: identity |
| 9 | +ms.topic: overview |
| 10 | +ms.date: 01/17/2023 |
| 11 | +ms.subservice: hybrid |
| 12 | +ms.author: billmath |
| 13 | +ms.collection: M365-identity-device-management |
| 14 | +--- |
| 15 | + |
| 16 | + |
| 17 | +# Migrating from Azure AD Connect to Azure AD Connect cloud sync |
| 18 | + |
| 19 | +Azure AD Connect cloud sync is the future for accomplishing your hybrid identity goals for synchronization of users, groups, and contacts to Azure AD. It uses the Azure AD cloud provisioning agent instead of the Azure AD Connect application. If you're currently using Azure AD Connect and wish to move to cloud sync, the following document provides guidance. |
| 20 | + |
| 21 | +## Steps for migrating from Azure AD Connect to cloud sync |
| 22 | + |
| 23 | + |
| 24 | + |
| 25 | +|Step|Description| |
| 26 | +|-----|-----| |
| 27 | +|Choose the best sync tool|Before moving to cloud sync, you should verify that cloud sync is currently the best synchronization tool for you. You can do this task by going through the wizard [here](https://setup.microsoft.com/azure/add-or-sync-users-to-microsoft-365).| |
| 28 | +|Verify the pre-requisites for migrating|The following guidance is only for users who have installed Azure AD Connect using the Express settings and aren't synchronizing devices. Also you should verify the cloud sync [pre-requisites](how-to-prerequisites.md).| |
| 29 | +|Back up your Azure AD Connect configuration|Before making any changes, you should back up your Azure AD Connect configuration. This way, you can role-back. For more information, see [Import and export Azure AD Connect configuration settings](../hybrid/how-to-connect-import-export-config.md).| |
| 30 | +|Review the migration tutorial|To become familiar with the migration process, review the [Migrate to Azure AD Connect cloud sync for an existing synced AD forest](tutorial-pilot-aadc-aadccp.md) tutorial. This tutorial guides you through the migration process in a sandbox environment.| |
| 31 | +|Create or identify an OU for the migration|Create a new OU or identify an existing OU that contains the users you'll test migration on.| |
| 32 | +|Move users into new OU (optional)|If you're using a new OU, move the users that are in scope for this pilot into that OU now. Before continuing, let Azure AD Connect pick up the changes so that it's synchronizing them in the new OU.| |
| 33 | +|Run PowerShell on OU|You can run the following PowerShell cmdlet to get the counts of the users that are in the pilot OU. </br>`Get-ADUser -Filter * -SearchBase "<DN path of OU>"`</br> Example: `Get-ADUser -Filter * -SearchBase "OU=Finance,OU=UserAccounts,DC=FABRIKAM,DC=COM"`| |
| 34 | +|Stop the scheduler|Before creating new sync rules, you need to stop the Azure AD Connect scheduler. For more information, see [how to stop the scheduler](../hybrid/how-to-connect-sync-feature-scheduler.md#stop-the-scheduler). |
| 35 | +|Create the custom sync rules|In the Azure AD Connect Synchronization Rules editor, you need to create an inbound sync rule that filters out users in the OU you created or identified previously. The inbound sync rule is a join rule with a target attribute of cloudNoFlow. You'll also need an outbound sync rule with a link type of JoinNoFlow and the scoping filter that has the cloudNoFlow attribute set to True. For more information, see [Migrate to Azure AD Connect cloud sync for an existing synced AD forest](tutorial-pilot-aadc-aadccp.md#create-custom-user-inbound-rule) tutorial for how to create these rules.| |
| 36 | +|Install the provisioning agent|If you haven't done so, install the provisioning agent. For more information, see [how to install the agent](how-to-install.md).| |
| 37 | +|Configure cloud sync|Once the agent is installed, you need to configure cloud sync. In the configuration, you need to create a scope to the OU that was created or identified previously. For more information, see [Configuring cloud sync](how-to-configure.md).| |
| 38 | +|Verify pilot users are synchronizing and being provisioned|Verify that the users are now being synchronized in the portal. You can use the PowerShell script below to get a count of the number of users that have the on-premises pilot OU in their distinguished name. This number should match the count of users in the previous step. If you create a new user in this OU, verify that it's being provisioned.| |
| 39 | +|Start the scheduler|Now that you've verified users are provisioning and synchronizing, you can go ahead and start the Azure AD Connect scheduler. For more information, see [how to start the scheduler](../hybrid/how-to-connect-sync-feature-scheduler.md#start-the-scheduler). |
| 40 | +|Schedule you remaining users|Now you should come up with a plan on migrating more users. You should use a phased approach so that you can verify that the migrations are successful.| |
| 41 | +|Verify all users are provisioned|As you migrate users, verify that they're provisioning and synchronizing correctly.| |
| 42 | +|Stop Azure AD Connect|Once you've verified that all of your users are migrated, you can turn off the Azure AD Connect synchronization service. Microsoft recommends that you leave the server is a disabled state for a period of time, so you can verify the migration was successful |
| 43 | +|Verify everything is good|After a period of time, verify that everything is good.| |
| 44 | +|Decommission the Azure AD Connect server|Once you've verified everything is good you can use the steps below to take the Azure AD Connect server offline.| |
| 45 | + |
| 46 | + |
| 47 | + |
| 48 | + |
| 49 | + |
| 50 | + |
| 51 | +## Verify Users script |
| 52 | +```PowerShell |
| 53 | +# Filename: VerifyAzureUsers.ps1 |
| 54 | +# Description: Counts the number of users in Azure that have a specific on-premises distinguished name. |
| 55 | +# |
| 56 | +# DISCLAIMER: |
| 57 | +# Copyright (c) Microsoft Corporation. All rights reserved. This |
| 58 | +# script is made available to you without any express, implied or |
| 59 | +# statutory warranty, not even the implied warranty of |
| 60 | +# merchantability or fitness for a particular purpose, or the |
| 61 | +# warranty of title or non-infringement. The entire risk of the |
| 62 | +# use or the results from the use of this script remains with you. |
| 63 | +# |
| 64 | +# |
| 65 | +# |
| 66 | +# |
| 67 | +
|
| 68 | +
|
| 69 | +Connect-AzureAD -Confirm |
| 70 | +
|
| 71 | +#Declare variables |
| 72 | +
|
| 73 | +$Users = Get-AzureADUser -All:$true -Filter "DirSyncEnabled eq true" |
| 74 | +$OU = "OU=Sales,DC=contoso,DC=com" |
| 75 | +$counter = 0 |
| 76 | +
|
| 77 | +#Search users |
| 78 | +
|
| 79 | +foreach ($user in $Users) { |
| 80 | + $test = $User.ExtensionProperty |
| 81 | + $DN = $test["onPremisesDistinguishedName"] |
| 82 | + if ($DN -match $OU) |
| 83 | + { |
| 84 | + $counter++ |
| 85 | + } |
| 86 | +} |
| 87 | +
|
| 88 | +Write-Host "Total Users found:" + $counter |
| 89 | +
|
| 90 | +``` |
| 91 | +## More information |
| 92 | + |
| 93 | +- [What is provisioning?](what-is-provisioning.md) |
| 94 | +- [What is Azure AD Connect cloud sync?](what-is-cloud-sync.md) |
| 95 | +- [Create a new configuration for Azure AD Connect cloud sync](how-to-configure.md). |
| 96 | +- [Migrate to Azure AD Connect cloud sync for an existing synced AD forest](tutorial-pilot-aadc-aadccp.md) |
| 97 | +`` |
0 commit comments