> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Sync an on-premise AD with Microsoft Entra ID External

You need to sync an on-premises AD with Microsoft Entra ID External and then sync it with Identity as a Service.

1. Use the Microsoft Entra Connect tool available at <https://www.microsoft.com/en-us/download/details.aspx?id=47594> to port users from On-premises AD into Microsoft Entra ID.

2. When configuring Microsoft Entra Connect to sync users into Microsoft Entra ID, you need to ensure to do the following in the **Entra Connect Wizard**:

3. Select **Password-hash synchronization** on the **User sign-in** page.

4. In the **Azure AD sign-in configuration** page, select the on-premise AD attribute that maps to UPN on Microsoft Entra ID from the **User Principal Name** drop-down list.

5. **In the Uniquely identifying your users page, do the following:**

   - Select **Users are only represented once across all forests**. This ensures that all users are created as individual objects in Azure AD.
   - Under **Select how users should be identified with Azure AD**, select **A specific attribute** and then select **ObjectGUID** from the drop-down list.

6. In the **Optional features** page, select **Password synchronization** and **Password writeback**.

7. Use PowerShell to run Entra Connect commands to initiate the sync operation between on-premises AD and Microsoft Entra ID.

   - Disable the scheduler by running the following command:

     `Set-ADSyncScheduler -SyncCycleEnabled $false`

   - Initiate a full sync cycle by entering the following command:

     `Start-ADSyncSyncCycle -PolicyType Initial`

8. Use the **Azure AD Synchronization Services** to confirm the synchronization operations. When the Services reports a Success status, go to the [Azure AD portal](https://portal.azure.com) to verify the changes.

9. Return to PowerShell and run the following command to re-enable the scheduler:

   `Set-ADSyncScheduler -SyncCycleEnabled $true`

note

If your On-premises AD user has a mail attribute that differs from the userPrincipalName attribute, the samAccountName attribute may change when synced to Microsoft Entra ID. You should review and resolve any issues before you Synchronize users with IDaaS. This could result in unexpected Identity as a Service userIDs.

attention

When performing the AD Connect operation, each user is automatically assigned a Microsoft ImmutableID that allows O365 SAML authentication. The value is equal to the on-premise AD objectGUID. When synchronizing Microsoft Entra ID users with Identity as a Service, do not map objectGUID to O365 ImmutableID on the User Defined Attributes tab. Instead, manually copy the value from the results of the following Powershell command into each users O365 ImmutableID field and save it:

`Get-MgUser -All -Property OnPremisesImmutableId,UserPrincipalName | Select OnPremisesImmutableId,UserPrincipalName`