Disabling Azure AD Connect

Question

Hi

I have some users left on prem and would like to convert them to Cloud accounts. I have come across a script to disable AD Connect and convert everyone at once 'Set-MsolDirSyncEnabled -EnableDirSync $false'.

However, I need to know that the users will not have any issues and that this will not reset their passwords.

Please advise on any possible user issues and whether their passwords will be reset.

Once everyone is cloud only I will remove AD connect

Regards

Answer 1

Hi @Stefan Diedericks

If you want users use the same password , you should enabling the synchronization of password hash before disabling the directory synchronization. If it's the case the user will able to resuse the same password when his Entra ID account will be converted to cloud only.

---

Please don't forget to accept helpful answer

Answer 2

Disabling it client-side means objects continue to be managed on-premises, and updates made will not be synchronized to Azure AD. However, if you disable it server-side, as in your case using the 'Set-MsolDirSyncEnabled -EnableDirSync $false' command, the objects will be "converted" to cloud-only and can be managed directly in Azure AD/Office 365. After disabling Azure AD Connect, passwords will no longer sync from your on-premises AD to Azure AD. Azure AD offers a feature called password writeback, which allows you to sync passwords reset in the cloud back to the on-premises AD. This feature is useful if you are using federation or password hash sync. When enabled, if users reset their passwords in Azure AD, these changes can be synchronized back to your local AD environment. It's worth noting that this feature requires DirSync to be up-to-date and enabled​

https://365tips.be/en/remove-azure-ad-connect-and-make-all-objects-cloud-managed/#:~:text=,Premise%20disappear%20instantaneously

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/deep-dive-password-reset-with-on-premise-sync-in-azure-ad/ba-p/243687