Entra Connect and Cloud Sync Hardening Guide

The server that synchronises Active Directory to Microsoft Entra ID holds credentials that can read every password hash in the forest and change the cloud password of every synced user, yet it is often run as an ordinary member server. Microsoft states that the Entra Connect server must be treated as a Tier 0 component, the same as a domain controller, and Storm-0501 showed why: ransomware operators pulled the sync account credentials from the server and used them to move from on-premises into the cloud tenant. This guide covers the identities that make hybrid sync work in Entra Connect Sync and Entra Cloud Sync, the admin roles around them, the pass-through authentication and password hash sync components, hard match and soft match takeover risks, logging, and a hardening baseline. It is written for identity engineers, Active Directory administrators and security architects running hybrid Microsoft environments. For the tenant-wide view, see the Active Directory and Entra ID Hardening Guide.

Key takeaways

Sync servers are Tier 0. Microsoft requires the Entra Connect server and every pass-through authentication agent server to be hardened like a domain controller, with administration only from privileged access workstations.
Three identities carry the bridge. The AD DS Connector account (MSOL_), the ADSync service account and the cloud Directory Synchronization Accounts identity together can read password hashes on-premises and set passwords in the cloud.
Move to application-based authentication now. Microsoft requires Entra Connect Sync 2.6.84.0 or later with application-based authentication by April 7, 2027, replacing the password-based cloud sync account with a certificate-backed application identity.
Block matching you do not need. Hard match and soft match can hand control of a cloud account, including its password hash, to whoever controls the matching on-premises object; turn both off outside planned migrations.
Keep cloud admins cloud-only. Synced privileged accounts turn a domain compromise into a tenant compromise; cloud-only admins with phishing-resistant MFA break that path.

How identity and access work in Entra Connect and Cloud Sync

Both products copy users, groups and (optionally) password hashes from Active Directory to Entra ID, but they place trust in different places.

Aspect	Entra Connect Sync	Entra Cloud Sync
On-premises footprint	Full sync engine with SQL Server LocalDB or a remote SQL Server; configuration held on the server	Lightweight provisioning agent; configuration stored in Entra ID and orchestrated by the cloud provisioning service
Connectivity	Outbound to Entra ID	Outbound only, through Azure Service Bus; sync runs every two minutes
On-premises service identity	AD DS Connector account (MSOL_ prefix with express settings) plus ADSync service account (virtual service account by default, gMSA for remote SQL)	Group managed service account used by the agent, with permissions applied by `Set-AADCloudSyncPermissions`
Cloud identity	Legacy: user account with the Directory Synchronization Accounts role. Current: application identity with certificate credential	Provisioning agent registered to the tenant
High availability	One active server plus staging servers	Multiple active agents with automatic failover
Feature gaps	None relative to Cloud Sync for core sync	No pass-through authentication configuration, no device writeback, groups up to 50,000 members, up to 150,000 objects per domain, limited attribute filtering

Authentication methods that ride on sync

Password hash synchronisation (PHS): the AD DS Connector account needs Replicate Directory Changes and Replicate Directory Changes All on each domain. Those are the same rights abused in DCSync (ATT&CK T1003.006), which is why whoever controls this account controls every hash. See the Golden Ticket, Silver Ticket and DCSync Guide.
Pass-through authentication (PTA): agents make outbound connections only (port 443, plus port 80 for certificate revocation lists), authenticate to Entra ID with a per-agent certificate whose RSA 2,048-bit private key stays on the server, pull encrypted passwords from a tenant-specific Service Bus queue and validate them against AD. The agent runs as NetworkService and the updater as LocalSystem. Microsoft says to treat every PTA agent server as Tier 0. Tampering with PTA is a known persistence route (ATT&CK T1556.007 Hybrid Identity).
Federation: where AD FS is used, the federation trust is another Tier 0 dependency. Storm-0501 added a rogue federated domain to forge SAML tokens (T1484.002 Trust Modification, T1606.002 SAML Tokens). See the Federation and Trust Relationships Guide. If PingFederate is your federation provider, see our Ping Identity Security Hardening Guide.

Admin roles and privileged access

Role or group	Where	What it controls	Hardening note
Hybrid Identity Administrator	Entra ID (marked privileged)	Cloud provisioning, Entra Connect, PTA, PHS, seamless SSO and federation settings; registers PTA agents	Eligible only through PIM, phishing-resistant MFA. The wizard needs it assigned directly, not through a group.
Global Administrator	Entra ID	Everything, including installing the Connect Health agent	Use only where Hybrid Identity Administrator is insufficient.
Directory Synchronization Accounts	Entra ID	Described by Microsoft as "Only used by Microsoft Entra Connect service"; assigned only by the wizard	Never assign to people. Review members: Entra ID allows at most 20 sync service accounts, and stale ones from rebuilt servers linger.
Application Administrator and Cloud Application Administrator	Entra ID	Can add credentials to applications, including the Connect Sync application	Microsoft warns this can be an elevation of privilege once application-based authentication is used. Treat these roles as Tier 0 in hybrid tenants.
Local Administrators and ADSyncAdmins on the sync server	Server	Can read the encrypted sync credentials and change sync rules	Restrict to a small Tier 0 group; no Tier 1 or helpdesk members.
Enterprise Admin or Domain Admin	AD	Needed for express install and for Cloud Sync permission cmdlets	Use for setup only; since build 1.4 the AD DS Connector account itself cannot be EA or DA.

Administer from PAWs: Microsoft requires dedicated privileged access workstations, a separate account per administrator, no browsing or email from privileged accounts, no NTLM to or from the server, and Windows LAPS for the local administrator. See the Tiered Administration and Enterprise Access Model Guide and the Local Administrator Password Solution (LAPS) Guide.
Downgrade the install account: after setup only the sync identity is needed. Microsoft suggests changing the installing Hybrid Identity Administrator account to a lower role rather than deleting it, because rerunning the wizard may need it.
Phishing-resistant wizard sign-in: from version 2.6.91.0 the wizard supports passkeys and FIDO2 keys through Web Account Manager, enabled by default. See the Phishing-Resistant MFA Guide.
Cloud-only privileged accounts: do not sync on-premises accounts to Entra roles. Microsoft advises strongly against syncing on-premises accounts onto pre-existing cloud admin accounts.

Integrations, API tokens and service accounts

The sync bridge is a cluster of non-human identities. Each needs an owner, a documented permission set and a rotation or replacement plan. See the Service Account Security Guide.

Identity	Default form	Permissions	Hardening
AD DS Connector account	MSOL_ user in the forest root Users container, long non-expiring password	Replicate Directory Changes (All) for PHS; read/write on users, groups, contacts; reset password for writeback	Set exact permissions with the ADSyncConfig.psm1 module, remove what you do not use (writeback, Exchange hybrid), deny interactive logon, alert on any logon not from the sync server.
ADSync service account	Virtual service account (VSA) on the sync server	Runs the sync engine and decrypts stored credentials	Use a gMSA when SQL is remote. The account choice is fixed at install.
Legacy Entra Connector account	User account `Sync_<server>[email protected]` with the Directory Synchronization Accounts role, password-based	Write synced objects; Storm-0501 showed it could be used to set passwords on hybrid accounts through Microsoft Graph	Replace with application-based authentication, then remove with `Remove-ADSyncAADServiceAccount`.
Application identity (application-based authentication)	Single-tenant application using OAuth 2.0 client credentials with a certificate	Sync writes to Entra ID	Prefer the Connect-managed certificate stored in a TPM (90-day lifetime, renewed at 70%); with bring-your-own certificate, use a non-exportable 2,048-bit RSA key in a TPM or HSM.
Cloud Sync gMSA	gMSA created at agent install	BasicRead, PasswordHashSync, PasswordWriteBack, HybridExchangePermissions, ExchangeMailPublicFolderPermissions, UserGroupCreateDelete	Grant only the permission types needed with `Set-AADCloudSyncPermissions`; run `Set-AADCloudSyncRestrictedPermissions` to strip inherited ACLs on the account.
PTA agent certificate	Per-agent certificate, tenant ID in the subject	Receive and validate sign-in requests	Renewed automatically 30 days before expiry; an expired agent is removed and must be re-registered by a Hybrid Identity Administrator.

Application-based authentication

Entra Connect Sync historically authenticated to Entra ID with a username and password stored on the server, encrypted with DPAPI. Microsoft's Storm-0501 analysis found the attackers extracted those credentials in plaintext after stealing DPAPI keys. Application-based authentication replaces the password with a certificate credential and the OAuth 2.0 client credentials flow. It needs version 2.5.3.0 or later for manual onboarding and 2.5.76.0 or later for automatic onboarding, and the version history states that Entra Connect Sync must be upgraded to 2.6.84.0 or later with application-based authentication configured by April 7, 2027, after which legacy authentication stops working. From 2.6.84.0 the wizard no longer silently falls back to the legacy account if application setup fails, so existing servers must be switched deliberately with "Configure application-based authentication to Microsoft Entra ID".

Upgrade: install the latest version from the Entra admin center (new builds are not on the Download Center). Microsoft retires 2.x versions 12 months after a newer one ships.
Choose the certificate model: Connect-managed (TPM recommended; event 1014 warns when no TPM is used) unless policy requires your own CA.
Switch staging servers first, confirm export runs cleanly, then switch the active server.
Remove the legacy DSA account and confirm the Directory Synchronization Accounts role has no orphaned members.
Rollback: disable the scheduler, run Add-ADSyncAADServiceAccount, confirm Get-ADSyncEntraConnectorCredential shows ServiceAccount, re-enable the scheduler; allow up to 15 minutes for the recreated account to work.

Logging and detection

Signal	Source	Why it matters (ATT&CK)
Sign-in by the sync identity from any host other than the sync server	Entra sign-in logs (service principal or user sign-ins)	Stolen sync credentials in use (T1078.004 Cloud Accounts)
Password set or reset on hybrid users by the sync identity outside sync cycles	Entra audit logs	Account takeover via sync identity (T1098 Account Manipulation)
Replication requests from hosts other than DCs or the sync server	DC security logs, identity threat detection (for example "Suspected DCSync attack")	MSOL_ rights used elsewhere (T1003.006)
New domain added, domain converted to federated, or new federation signing certificate	Entra audit logs; Microsoft's federation change monitoring guidance	Federated backdoor (T1484.002)
New credential added to the Connect Sync application	Entra audit logs, application credential changes	Application identity hijack (T1098.001 Additional Cloud Credentials)
New PTA agent registered, or agent on an unknown host	Entra admin center PTA agent list, audit logs	Rogue authentication agent (T1556.007)
Certificate events 1011 (expiring) and 1012 (expired)	Application event log on the sync server	Sync outage risk after moving to application-based authentication
Sync matching errors `InvalidHardMatch`, `AttributeUpdateNotAllowed`, `InvalidSoftMatch`	Sync error reports	Attempted or accidental takeover via matching

Add a Conditional Access policy that restricts the sync identity to the sync servers' egress IP addresses, as Microsoft recommended after Storm-0501. See the Conditional Access Guide and the ITDR Guide.

Metrics that show it is working

Application-based authentication coverage: share of active and staging sync servers using an application identity (target 100% well before April 7, 2027).
Synced privileged accounts: number of users holding or eligible for privileged Entra roles whose source of authority is on-premises (target 0).
Tier 0 admin population: count of accounts with local admin or ADSyncAdmins on sync and PTA servers (trend down, reviewed quarterly).
Matching blocks: BlockSoftMatch and BlockCloudObjectTakeoverThroughHardMatch enabled, with days open per migration exception.
Version currency: days until the running version's end of support date.

Hardening baseline

Classify and isolate: place Entra Connect, Cloud Sync agent and PTA agent servers in the Tier 0 OU with domain controller group policy, on Windows Server 2025 or 2022, and allow management only from Tier 0 PAWs.
Lock down server access: restrict local Administrators and ADSyncAdmins, block NTLM, deploy Windows LAPS, run EDR with tamper protection, and do not intercept TLS between the server and Entra ID (Microsoft warns this can break the service).
Least privilege for connector identities: use ADSyncConfig.psm1 (Connect) or Set-AADCloudSyncPermissions and Set-AADCloudSyncRestrictedPermissions (Cloud Sync) to grant only needed rights; drop password writeback and Exchange permissions you do not use.
Move to application-based authentication on version 2.6.84.0 or later, and remove the legacy sync account.
Block matching: set BlockSoftMatchEnabled and BlockCloudObjectTakeoverThroughHardMatchEnabled to true with Update-MgDirectoryOnPremiseSynchronization; open them only for a dated migration window. Note that blocking soft match can cause InvalidSoftMatch errors for new hybrid joined devices.
Keep the hard match protection on: from July 1, 2026, Entra ID blocks a hard match to an account that already has onPremisesObjectIdentifier set or holds, or is eligible for, a privileged role. Leave AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled off except during a validated recovery.
Protect cloud privilege: cloud-only admin accounts, Hybrid Identity Administrator through PIM, phishing-resistant authentication strength, and Conditional Access restricting the sync identity by location.
Harden federation: monitor federation changes and, where federation remains, set federatedTokenValidationPolicy with validatingDomains set to all, as Microsoft recommended after Storm-0501, to reject SAML sign-ins for non-federated domains.
Plan recovery: keep a documented rebuild of the sync server, a tested staging server, and a cloud-only break-glass account. See the Identity Recovery Guide.

Choosing Connect Sync or Cloud Sync

Cloud Sync reduces what sits on-premises: configuration lives in Entra ID, agents update themselves and several agents run actively. That shrinks the local attack surface, but the agent and its gMSA still hold directory permissions, so the agent server remains Tier 0. Connect Sync remains necessary where you need pass-through authentication configuration, device writeback, groups larger than 50,000 members, more than 150,000 objects per domain, or advanced sync rules. Small organisations with a single forest and PHS usually fit Cloud Sync; large or multi-forest estates often run both during migration. Microsoft documents that agents may run on domain controllers; that is acceptable only because a DC is already Tier 0, not as a cost shortcut for member servers.

Framework mapping

Control area	NIST SP 800-53 Rev. 5	NIST CSF 2.0	CIS Controls v8.1
Sync and agent identities, certificate credentials	IA-5, SC-12, AC-2	PR.AA-01	5 Account Management
Tier 0 admin access, least privilege for connectors	AC-6, AC-2	PR.AA-05	6 Access Control Management
Phishing-resistant MFA for hybrid admins	IA-2	PR.AA-01	6 Access Control Management
Supported versions, matching blocked, NTLM off	CM-7	PR.PS-01	4 Secure Configuration
Sync identity and federation monitoring	AU-6, AU-12	DE.CM-03, DE.CM-09	8 Audit Log Management

Common misconfigurations

Sync server managed as Tier 1: backup agents, monitoring tools and helpdesk admins on the sync server give a Tier 1 attacker a direct path to Tier 0 credentials. In the Storm-0501 hybrid cloud attacks, the operators located the sync servers after taking over the domain and extracted plaintext sync credentials from them.
Synced Global Administrators without MFA: Storm-0501 also pivoted through a Domain Admin whose cloud counterpart held Global Administrator with MFA disabled.
Matching left open: soft match and hard match enabled permanently, letting anyone who can create or edit an AD object with a matching UPN, proxy address or sourceAnchor take over a cloud account and, with PHS, overwrite its password hash.
Default express permissions kept: password writeback and reset rights granted to the MSOL_ account even though writeback is not used.
Orphaned sync accounts and agents: old Directory Synchronization Accounts members and PTA agents from decommissioned servers, still valid and unmonitored.
Unsupported versions: servers running versions past their 12-month retirement date, missing security fixes and the application-based authentication deadline.

Practitioner checklist

Entra Connect, Cloud Sync agent and PTA agent servers are in the Tier 0 boundary and managed only from PAWs.
Entra Connect Sync runs a supported version, 2.6.84.0 or later, with application-based authentication and the legacy sync account removed.
The Directory Synchronization Accounts role and the PTA agent list contain only current servers.
MSOL_ and Cloud Sync gMSA permissions are trimmed to the features in use.
BlockSoftMatch and BlockCloudObjectTakeoverThroughHardMatch are enabled outside approved migration windows.
No privileged Entra role is held by a synced account; Hybrid Identity Administrator is PIM-eligible with phishing-resistant MFA.
Application Administrator and Cloud Application Administrator holders are reviewed as Tier 0.
Conditional Access restricts the sync identity to sync server IP addresses, and its sign-ins elsewhere raise an alert.
Alerts exist for federation changes, new application credentials on the sync app and replication requests from non-DC hosts.

Microsoft Entra Connect and Cloud Sync Hardening Guide: Protecting the Hybrid Identity Bridge