Entra Connect Sync in autumn 2026: three deadlines IT teams must not confuse

IT administrators managing hybrid Entra and Active Directory environments have received multiple notifications via the Microsoft 365 Message Center in recent weeks. The messages all relate to Entra Connect Sync, the service that synchronises on-premises Active Directory with Entra ID in the cloud. Many teams are treating these notifications as one large migration project, but that is a mistake. Three separate stories are unfolding, each with its own deadline and its own required action. Confusing them risks losing functionality or leaving a security gap open.

Deadline 1 — The mandatory in-place upgrade before 30 September 2026

This is the most urgent deadline and the simplest action. Microsoft is ending support for all versions of Entra Connect Sync older than version 2.5.79.0 on 30 September 2026. Any organisation still running an older version on that date will lose synchronisation. Identities will no longer be updated between on-premises Active Directory and Entra ID, passwords will no longer be synchronised, and user accounts can fall out of step with what is registered in the cloud.

This is not a migration to Cloud Sync. It is a mandatory in-place version update of the Connect Sync service running on-premises. You can check your current version via the Entra Connect Health portal or from the properties of the synchronisation server itself. If the version is below 2.5.79.0, schedule the upgrade as soon as possible. The upgrade follows the standard update path via the Microsoft Download Center and typically takes about an hour including the restart of the synchronisation service. Schedule it before the end of August to give yourself a buffer before the 30 September deadline.

Deadline 2 — Hard match hardening, already active since 1 July

On 1 July 2026, Microsoft introduced a security hardening change in the matching logic of Connect Sync. The technique is called hard match hardening and it closes a real security gap. Before 1 July, it was theoretically possible for an attacker with control over an on-premises AD object and knowledge of the corresponding ImmutableID to take over an Entra ID account via the soft match process. That risk no longer exists.

However, the hardening has side effects for environments where the sourceAnchor was not set consistently, or where accounts were manually linked in the past via soft match without a formal hard match being established. In those cases, some tenants experienced unexpected synchronisation errors or objects temporarily disappearing from Entra ID after 1 July. If your organisation encountered sync errors after 1 July, check the Entra Connect Health dashboard for objects with an ImmutableID conflict. In most cases the remediation is straightforward, but it does require action, and it is best resolved before carrying out the in-place upgrade.

Deadline 3 — The Cloud Sync migration, a separate and phased process

The notifications attracting the most attention are the invitations to transition from Entra Connect Sync to the cloud-native Entra Cloud Sync. This is a fundamentally different service. Cloud Sync runs entirely in the cloud, with no local server installation. Configuration is done through the Entra portal, updates are rolled out automatically, and the service does not depend on the availability of a single on-premises server. In principle that is a significant improvement in the resilience of the identity infrastructure.

Microsoft began sending migration notifications via the Message Center in July 2026 to tenants where Cloud Sync already fully meets their synchronisation needs. This is Phase 1 of the transition, targeting organisations with relatively straightforward configurations. Phase 2, for organisations with large Active Directory environments of a hundred thousand objects or more, advanced custom synchronisation rules, or Exchange hybrid write-back, extends into 2027. A Phase 1 notification is not an obligation to start migrating tomorrow. It is an invitation to assess migration readiness and draw up a plan at a time that suits your organisation.

What Cloud Sync cannot yet do

Anyone considering migrating to Cloud Sync should understand the current functional gaps. Cloud Sync does not currently support all the capabilities of Connect Sync. Custom synchronisation rules and complex transformations at the metaverse level cannot be carried across one-to-one. Organisations that rely heavily on advanced filtering logic or specific attribute mappings need more preparation before they can migrate.

The Exchange writeback feature deserves particular attention: it writes email attributes from Entra ID back to on-premises Active Directory and is indispensable in hybrid Exchange environments. Microsoft offers a coexistence path for this scenario: a minimal Connect Sync installation continues to handle Exchange writeback only, while the remainder of synchronisation has already moved to Cloud Sync. This is the recommended migration route for organisations still running on-premises Exchange.

Which action belongs to which deadline?

To make the three stories concrete: here is the checklist for an IT team starting today. First, check the version of Entra Connect Sync via the Entra Connect Health portal or the synchronisation server. If you are below version 2.5.79.0, schedule the upgrade as soon as possible, preferably before the end of August.

Second, check the Entra Connect Health dashboard for synchronisation errors that appeared after 1 July 2026. Filter for objects with ImmutableID conflicts or soft match problems. Resolve these before you carry out the in-place upgrade, so you are not dealing with pre-existing errors and a new version at the same time.

Third, check the Microsoft 365 admin centre for Phase 1 notifications about Cloud Sync. If you have received one, start a migration assessment: which synchronisation rules are active, is Exchange writeback configured, how large is your Active Directory, and are there custom attribute mappings in place? Based on that inventory, you can determine whether your organisation can migrate within a few months or needs more preparation time. The three actions are independent of each other: even if your Cloud Sync migration does not happen until 2027, you need to carry out the version upgrade and the hard match check now.

Why Cloud Sync is the future

Cloud Sync is not merely a cosmetic modernisation of Connect Sync. It removes the on-premises synchronisation server as a dependency, reducing management overhead and strengthening continuity. In a hybrid identity environment, synchronisation remains a critical process, but with Cloud Sync the availability of a single local server no longer determines the fate of that synchronisation. Configuration changes flow through the Entra portal, audit logs are built into Entra ID, and version updates roll out automatically. No more manual upgrades of an on-premises package, no scheduled maintenance windows to patch the synchronisation server.

For IT teams that have already made the switch, the result is fewer incidents around identity synchronisation and less dependency on specific expertise about a complex on-premises installation. The architecture is simpler and therefore less prone to failure. Three stories, three deadlines, three actions you can plan for now. Want help assessing your Connect Sync configuration, preparing the version upgrade, or determining your readiness to migrate to Cloud Sync? Contact Zarioh to speak with one of our specialists.