Demote Last Domain Controller and Impact on Synced Users in Entra ID

Question

What is the impact on synced users in Entra ID when demoting the last domain controller for a synced domain?

Answer 1

Hi @SF-6505 •

If you want delete synced user, before demoting the last domain controller you should:

• In the connector you remove all synced OUs
• Run a full sync (if the number of deleted objects exceed the threshold you should to disable it temporary)
• Demote the last domain controllers

If you want keep synced users in Entra ID you should follows theses steps:

• Check if the Password hash synchronization is enabled
• Turnoff the directory synchronization , all synced users from this domain will be converted to Cloud Only accounts
• Demote the last domain controller

Answer 2

In summary:

• Demoting the last domain controller disrupts on-premises AD DS.
• Entra ID users who have already been synchronized will generally retain their cloud identities.
• The Microsoft Entra connect server is the critical link, and it's continued function is paramount.

It's highly recommended to consult Microsoft's official documentation and best practices before making significant changes to your identity infrastructure.