Entra Staged Rollout: From AD FS to PHS

Key insights

• Staged Rollout lets you migrate users in waves from on-premises AD FS to cloud authentication without switching the whole domain at once.
  Use it to pilot cloud sign-ins and reduce risk while most users remain federated.
• Setup is simple: enable Password Hash Sync (PHS) or Pass-Through Authentication (PTA) in Entra Connect, turn on staged rollout in the Entra admin center, and add a security group of pilot users.
  Members of that group authenticate against Entra ID while others keep AD FS.
• A background job stamps each user with a hidden attribute, and sign-in checks that stamp — not the group directly.
  This design explains the up-to-24-hour propagation delay, the initial 200-user add limit, and why nested or dynamic groups don’t work reliably.
• Know the limits: legacy auth, certain domain_hint apps, and nonpersistent VDI sessions stay on federation and don’t flip to cloud auth.
  Users often need an interactive sign-in and token invalidation for the new path to take effect.
• Benefits include clear risk mitigation (no big-bang cutover), the ability to validate MFA and Conditional Access with real users, and granular control via groups (up to 10 groups, large membership limits but must start small).
• When ready to finish the migration, run the PowerShell cutover:
  Connect-MgGraph -Scopes "Domain.ReadWrite.All" then
  Update-MgDomain -DomainId "yourdomain.com" -AuthenticationType "Managed".
  That single-step change converts the domain to managed authentication after testing.

Summary of the video

In a recent YouTube video, Merill Fernando explains Microsoft Entra’s Staged Rollout and how it lets administrators move users from on-premises AD FS to cloud authentication without a one-day domain-wide cutover. He frames the feature as a way to pilot cloud sign-in for a subset of users while the rest of the domain continues to use federation, reducing risk. The video combines a conceptual walk-through with a practical demo, and it highlights a lesser-known implementation detail that affects timing and behavior.

How staged rollout actually works

Fernando first outlines the core flow: enable Password Hash Sync (or Pass-Through Authentication) in the synchronization tool, turn on staged rollout in the Entra admin center, and assign pilot users via security groups. Then, members of that group authenticate directly with Entra ID instead of being routed to AD FS, which lets them use cloud features such as MFA and Conditional Access. Importantly, sign-in routing does not re-evaluate the group live; instead, an internal stamp is applied to each user and the sign-in logic reads that stamp.

The hidden attribute and timing constraints

A central insight Fernando emphasizes is the hidden attribute that Entra applies to users as part of the staged rollout process. This attribute is set by a background job and it is the value that the authentication flow checks at sign-in, not the group membership itself. As a result, adding a user to the rollout group does not produce an immediate sign-in switch; the background stamping can take time and explains the documented delay of up to 24 hours between group assignment and sign-in change.

Technical limits and practical trade-offs

The video also spells out practical limits that shape migration planning. For example, staged rollout requires starting with no more than 200 users in a new group and disallows nested and dynamic groups for the switch, because the stamping job expects stable, direct membership. These constraints trade flexibility for predictable behavior: administrators gain controlled testing and lower risk, but they must manage more groups and accept delays during gradual expansion. Moreover, organizations must choose between PHS and PTA—you can enable only one at a time within staged rollout—which forces teams to weigh security posture, auditability, and operational preferences.

What remains on federation and migration steps

Fernando clarifies that not everything migrates to cloud auth when a user is part of the staged rollout. Legacy authentication protocols, applications that rely on domain_hint, and certain nonpersistent VDI scenarios can still route via federation. Therefore, staged rollout reduces risk but does not eliminate the need to keep AD FS available until a full migration and compatibility testing are complete. For the final domain cutover, he demonstrates a concise approach using Microsoft Graph PowerShell to switch the domain authentication type to managed in a single command, emphasizing simplicity at the final step.

Cutover command and operational checklist

To perform the final conversion after validating the pilot, Fernando shows how administrators can authenticate to Microsoft Graph and update the domain. The commands he demonstrates are to connect and then update the domain authentication type, which he presents as a brief two-step finish to the staged rollout. Teams should, however, prepare by invalidating tokens, ensuring users perform interactive sign-ins, and revisiting any legacy apps that still expect federation.

Challenges for IT teams and final considerations

Balancing speed and caution is the main challenge highlighted in the video. On one hand, staged rollout reduces blast radius and lets teams adopt cloud features gradually; on the other hand, the stamping delay, group limitations, and continued need for AD FS for some scenarios demand careful coordination. Administrators must plan communications, test legacy application behavior, and monitor the background processes that apply the hidden attribute to avoid surprises during each expansion wave.

Conclusion

Merill Fernando’s video presents a clear, practical view of how Entra staged rollout de-risks migration from AD FS to cloud authentication. It balances conceptual explanation with hands-on steps and highlights the subtle technical behavior that explains common timing and group rules. For IT teams, the takeaway is to pilot conservatively, understand the stamping behavior and group rules, and prepare for a final, simple cutover only after validation and cleanup.

Keywords

Entra staged rollout, AD FS to Password Hash Sync migration, Password Hash Sync guide, Azure AD Connect staged rollout, Migrate AD FS to Password Hash Sync, Entra ID staged rollout, Hybrid identity migration AD FS, Staged rollout best practices