"Cloud Sync AD to Entra — How to prevent user deletion when removed from sync scope?"

Chloe Hall 15 Reputation points
2026-06-19T02:33:25.6966667+00:00

I have a single Cloud Sync configuration syncing from on-premises AD to Entra ID. During testing I discovered that when a user falls out of sync scope and I evaluate them via Provision on Demand, their Entra account gets deleted.

I need to change the deprovisioning behavior so that out-of-scope users are made cloud-only instead of deleted.

Environment:

  • Single Cloud Sync agent on one server
  • AD to Entra provisioning job (AD2AADProvisioning)
  • PHS enabled
  • Scheduled sync currently disabled — still in testing

Question: Is there a supported way to configure deprovisioning behavior for a Cloud Sync AD→Entra job to leave accounts as cloud-only instead of deleting them when they fall out of scope?I have a single Cloud Sync configuration syncing from on-premises AD to Entra ID. During testing I discovered that when a user falls out of sync scope and I evaluate them via Provision on Demand, their Entra account gets deleted.

I need to change the deprovisioning behavior so that out-of-scope users are made cloud-only instead of deleted.

What I've already tried:

  • Looking for the setting in the Cloud Sync UI — not present
  • SkipOutOfScopeDeletions — did not prevent deletion
  • Checking job schema for deprovision settings — nothing returned

Environment:

  • Single Cloud Sync agent on one server
  • AD to Entra provisioning job (AD2AADProvisioning)
  • PHS enabled
  • Scheduled sync currently disabled — still in testing

Question:
Is there a supported way to configure deprovisioning behavior for a Cloud Sync AD→Entra job to leave accounts as cloud-only instead of deleting them when they fall out of scope?

Microsoft Security | Microsoft Entra | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Chloe Hall 15 Reputation points
    2026-06-19T02:40:47.8333333+00:00

    Testing shows that matched users are deleted from Entra when they fall out of scope. What is the supported Microsoft process to exclude this user from Cloud Sync management without deleting the Entra account?

    User was tested with provision on demand and so now they're stuck in that ad group until they can safely be remvoed.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.