Microsoft Entra: disable directory sync after migration

Key insights

• The migration sequence in the demonstration moves groups and users to cloud management before disabling directory synchronization.
• Check that devices are Entra joined and Intune managed, and that no apps still depend on on-premises authentication.
• The demonstration recommends 30–90 days of parallel operations, with monitoring, before the final transition.
• Disabling sync can be initiated with Microsoft Graph PowerShell or the Graph API; the demonstration says the change may take up to 72 hours.
• Export Active Directory objects and document the change before decommissioning domain services.

Microsoft Entra directory synchronization can be disabled after an organization has migrated its users and groups to cloud management and confirmed that on-premises dependencies are gone. This final step matters to identity and infrastructure administrators planning to retire Entra Connect Sync and, eventually, Active Directory Domain Services. Andy Malone [MVP] demonstrates the transition and describes checks to complete before turning off synchronization.

What's new

This is a migration procedure, not a newly announced Entra feature. It changes the organization from a hybrid identity setup, where directory objects are synchronized from on-premises Active Directory, to a cloud-managed identity setup. The key tenant-level setting is , which the demonstration changes to false.

That setting is only one part of the project. Users and groups need to be migrated so their source of authority is in the cloud, and services or applications must not rely on the local directory for authentication. The video presents disabling synchronization as a last-stage action, after those migrations and a period of coexistence—not as a shortcut for removing a domain controller.

Microsoft documentation covers managing directory synchronization and configuring the source of authority for users and groups. Those are separate considerations: changing the tenant synchronization state does not itself document whether every workload, device, or application in an organization is ready to operate without Active Directory.

Who it is for and what you need

This process is for administrators responsible for Microsoft Entra identity, Microsoft Entra Connect Sync, and the associated on-premises environment. The demonstration says to use a Global Administrator or Hybrid Identity Administrator for the relevant authentication and consent steps. It does not specify a Microsoft 365 or Entra license requirement, a rollout schedule, or regional availability.

Before making the change, the demonstration calls for devices to be Entra joined and managed with Intune, security groups to be transferred to Entra ID, and domain users to have their source of authority changed to Entra ID. It also says to confirm that no on-premises authentication dependencies remain and to review legacy systems and applications.

It recommends an extended coexistence period of 30 to 90 days, adjusted for the complexity and size of the environment, while monitoring for unexpected on-premises connections. Before removing Active Directory, it separately recommends a 30-day hold period for emergency recovery. These are recommendations in the demonstration, not stated Microsoft-wide requirements.

How it works

The transition involves preparation, disabling synchronization, and a separate decision about retiring on-premises directory services. The sequence matters: removing the sync software does not necessarily mean the tenant’s synchronization state has already changed. In the demonstration, the organization setting remains enabled after uninstalling the software, so the administrator updates it separately.

1. Complete the user and group migration. Verify the source of authority is cloud-based, and review whether devices, applications, authentication, Group Policy, and file-share permissions still rely on Active Directory.
2. Allow a monitored coexistence period. The demonstration recommends 30 to 90 days of parallel operations and says to check logs for unexpected on-premises connections.
3. Uninstall Microsoft Entra Connect Sync and associated components when ready. In the demonstration, the administrator uses Add or Remove Programs and removes the sync tool and related agents. The exact components will depend on the environment.
4. Update the tenant synchronization setting. The demonstration uses Microsoft Graph PowerShell to connect with the required scopes, check , set it to false, and check the value again. The Microsoft Graph API is presented as another way to make the update. Follow Microsoft's documentation for the supported command and permissions.
5. Check the result before proceeding. The demonstration refreshes the directory view and checks whether a migrated user's properties can be edited. It says the tenant change may take up to 72 hours, so do not treat an immediate lack of change as proof that the update failed.
6. Plan Active Directory Domain Services removal as a distinct project. Validate that applications no longer authenticate against AD, migrate or replace Group Policy, update file-share permissions, export directory objects for compliance, and retain backups and documentation.

Only after those checks does the demonstration describe uninstalling Active Directory Domain Services from a domain controller. It mentions PowerShell or Server Manager as removal paths, but the right approach depends on the organization's domain and server design.

Limitations and open questions

The demonstration does not establish that every hybrid environment can use the same sequence or that uninstalling Entra Connect Sync will automatically make every identity cloud-managed. Its description of automatic conversion in a small environment is presented as a scenario, and it says the process may take up to 72 hours. Administrators should verify their users' and groups' source of authority and follow the relevant Microsoft guidance before acting.

It also does not give a complete inventory method for finding every dependency, a universal rollback procedure, or a licensing matrix. The recommendation to export users, groups, and computers is a precaution, not a substitute for backups or a tested recovery plan. Treat domain controller removal, DNS changes, VPN updates, file-server migration, and replacement of DHCP or other services as separate infrastructure work.

Most importantly, “cloud native” here describes the identity outcome in the demonstration; it does not mean that Windows Server or hybrid infrastructure is generally retired. The video focuses on the final transition from synchronized identities and the later removal of Active Directory components in its example.

Sources

• Microsoft documentation: Set-EntraDirSyncEnabled
• Microsoft troubleshooting guidance for Entra Connect synchronization
• Configure user source of authority
• Configure group source of authority
• Andy Malone [MVP]: hybrid identity migration demonstration

Frequently asked questions

What should I check before disabling Microsoft Entra directory synchronization?

Confirm users and groups have been migrated to cloud management, devices are Entra joined and Intune managed, and applications no longer depend on on-premises authentication. The demonstration also recommends a monitored coexistence period.

How do I disable directory synchronization in Microsoft Entra?

The demonstration uses Microsoft Graph PowerShell to set the organization's OnPremisesSyncEnabled property to false, and also mentions the Graph API. Consult Microsoft's Set-EntraDirSyncEnabled documentation for the supported command and usage.

How long does disabling directory synchronization take?

The demonstration says the update can take up to 72 hours. It does not establish that this timing applies to every tenant or configuration.

Can I remove Active Directory as soon as synchronization is disabled?

Not based on this material alone. The demonstration recommends separately checking application authentication, Group Policy, file-share permissions, devices, backups, and other dependencies before removing Active Directory Domain Services.