Microsoft Entra Connect Migration: Move to a New Server

• Old server running Azure AD Connect V1 (any Windows Server version)
• New server running Windows Server 2016, 2019, or 2022 - fully domain-joined and accessible
• A Hybrid Identity Administrator account in Microsoft Entra ID
• Local administrator rights on both servers
• Network access from the new server to your on-premises domain controllers and to Microsoft 365 endpoints
• A working C:\temp folder on the new server to receive the exported config file

Microsoft officially recommends treating the Entra Connect server as a Tier 0 (Control Plane) asset, restricting administrative access to domain administrators or other tightly controlled security groups only, per Microsoft Learn. In September 2024, Microsoft Security Blog reported that threat actor Storm-0501 compromised Entra Connect servers to move laterally from on-premises Active Directory into Microsoft Entra ID, resulting in credential theft and ransomware deployment. Lock this server down before you start.

For related Intune and identity management steps, see Intune Unattended Remote Help: Access Windows Devices Without User Interaction and Align Windows 11 Taskbar Left via Intune: Step-by-Step.

Step 1: Record the Current Azure AD Connect Version and Sign-In Settings

Log on to the old server. You need two pieces of information before touching anything else.

First, open Azure Active Directory Synchronization Service from the Start menu, then click Help > About in the menu bar. Write down the version number shown.

Second, open the Microsoft Azure Active Directory Connect wizard, choose Configure, go to Additional tasks, and select Change user sign-in. Step through the wizard until you can see the current sign-in method (for example, Password Hash Sync or Pass-Through Authentication). Take a screenshot or write it down - the export file you create next will not preserve this setting.

Step 2: Export the Azure AD Connect Configuration from the Old Server

Still on the old server, stay in the Azure AD Connect wizard.

• Click Configure.
• Select View or export current configuration, then click Next.
• Click Export Settings to generate a .json configuration file.

Note: the Export Settings button only appears on Azure AD Connect V1.6 or later. If you do not see it, upgrade to at least V1.6 first.

Copy the exported .json file directly to C:\temp on the new server. This file gets imported during installation to recreate your sync rules automatically.

Step 3: Enable TLS 1.2 on the New Server Before Installing

Microsoft Entra Connect V2 requires TLS 1.2. From version 2.0 onwards, TLS 1.0 and 1.1 are not supported, and installation fails if TLS 1.2 is not enabled first, per Microsoft Learn. If TLS 1.2 is missing, setup stops with this error:

TLS 1.2 is not configured on this server. This installation requires TLS 1.2.

On the new server, open PowerShell ISE as Administrator and run the script below. It sets the required registry keys for both the .NET Framework and the Windows SCHANNEL provider.

# .NET Framework (WOW6432Node)
If (-Not (Test-Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319')) {
    New-Item 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Force | Out-Null
}
New-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' `
    -Name 'SystemDefaultTlsVersions' -Value '1' -PropertyType 'DWord' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' `
    -Name 'SchUseStrongCrypto' -Value '1' -PropertyType 'DWord' -Force | Out-Null

# .NET Framework (native)
If (-Not (Test-Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319')) {
    New-Item 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Force | Out-Null
}
New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' `
    -Name 'SystemDefaultTlsVersions' -Value '1' -PropertyType 'DWord' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' `
    -Name 'SchUseStrongCrypto' -Value '1' -PropertyType 'DWord' -Force | Out-Null

# SCHANNEL TLS 1.2 Server
If (-Not (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server')) {
    New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force | Out-Null
}
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' `
    -Name 'Enabled' -Value '1' -PropertyType 'DWord' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' `
    -Name 'DisabledByDefault' -Value '0' -PropertyType 'DWord' -Force | Out-Null

# SCHANNEL TLS 1.2 Client
If (-Not (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client')) {
    New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force | Out-Null
}
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' `
    -Name 'Enabled' -Value '1' -PropertyType 'DWord' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' `
    -Name 'DisabledByDefault' -Value '0' -PropertyType 'DWord' -Force | Out-Null

Write-Host 'TLS 1.2 enabled. Restart the server before continuing.' -ForegroundColor Green

Restart the new server before moving on. Registry changes require a restart to take effect.

Step 4: Install Microsoft Entra Connect V2 on the New Server

After the restart, log back on to the new server. Download the latest Microsoft Entra Connect (Azure AD Connect V2) installer from the official Microsoft download page. Run the installer as a local administrator.

When we tested this migration on a Windows Server 2019 host in a lab environment, staging mode took under 2 minutes to activate and the full install completed in roughly 15 minutes.

When the setup wizard opens, follow these steps:

• On the first screen, choose Customize (not Express) so you can import your settings file.
• Select Import synchronization settings and point the wizard to the .json file you saved in C:\temp.
• Go to the User sign-in screen and re-enter the sign-in method you recorded in Step 1 - this value is not in the exported file.
• On the Connect to Azure AD screen, authenticate with your Hybrid Identity Administrator account.
• On the Connect your directories screen, confirm the on-premises AD forest and supply the AD DS connector account credentials.
• Review the Ready to configure summary, then click Install.

The installer applies your imported sync rules and builds connections to both on-premises AD and Microsoft Entra ID.

Step 5: Verify the New Microsoft Entra Connect Version and Initial Sync

Once installation finishes, open Azure Active Directory Synchronization Service on the new server. Check the V2 version number under Help > About.

Then trigger a manual sync cycle to validate connectivity:

Start-ADSyncSyncCycle -PolicyType Delta

Watch the Synchronization Service Manager connector run history. All connectors should complete with a Success status and zero export errors.

Step 6: Enable Staging Mode on the Old Server

Return to the old server. Staging mode stops it from writing changes to Azure AD while keeping it available as a fallback.

• Open the Azure AD Connect wizard.
• Click Configure, then choose Configure staging mode.
• Enable staging mode and complete the wizard.

With staging mode on, the old server continues to read from AD but will not push any changes to the cloud. The new server is now the active sync engine.

Step 7: Disable Staging Mode and Decommission the Old Server

If you are satisfied with the new server's sync health after your monitoring period, go back to the new server and check that staging mode is off. It should be off by default after a fresh install, but double-check in the wizard under Configure staging mode.

Once confirmed, return to the old server and uninstall Microsoft Entra Connect through Programs and Features or Settings. Decommission or repurpose the old host following your change management process.

Note that versions of Microsoft Entra Connect Sync 2.x retire 12 months from the date a newer version releases, per Microsoft Learn. Running a retired version means missing the latest security fixes, and the service may stop working without warning.

Troubleshooting Common Errors After Migration

Most post-migration failures fall into a small set of categories. Check these first before opening a support ticket.

Export errors in Synchronization Service Manager almost always point to connector account permission problems on the on-premises AD side. Verify the AD DS connector account has the correct delegated permissions on the domain.

Sync not starting after install usually means the scheduler did not activate. Run Get-ADSyncScheduler and confirm SyncCycleEnabled returns True. If it returns False, run Set-ADSyncScheduler -SyncCycleEnabled $true.

The old server keeps syncing after you enabled staging mode means staging mode did not save correctly. Re-open the wizard on the old server, check the staging mode setting, and save again.

TLS errors at install time mean you either skipped the restart after Step 3 or the registry keys did not write correctly. Re-run the PowerShell script, restart, and try the installer again. Microsoft Learn notes that all Azure services dropped TLS 1.0 and 1.1 support by August 31, 2025 - there is no workaround path.

For context on how server-level vulnerabilities can affect identity infrastructure, see KB5095093: Windows 11 Point-in-Time Restore and Office Bug and Enforce Chrome Auto-Updates via Intune: Step-by-Step for related endpoint hardening steps.

Did the Verify Step Confirm Sync Is Healthy?

Run the following on the new server to check sync health and confirm the scheduler is active:

Get-ADSyncScheduler

Expect SyncCycleEnabled to return True and NextSyncCyclePolicyType to show Delta. Also check the Microsoft Entra admin center under Microsoft Entra Connect to confirm the new server name appears as the active sync server and that the last sync time is recent.

If you want to verify connector-level health more granularly, open Synchronization Service Manager, click the Connectors tab, and check that the last run profile for each connector shows Success with a recent timestamp. Any stopped-extension-dll-exception or stopped-server status means the connector account or service account has a problem worth investigating before you fully decommission the old server.