Azure AD Sync for On-Premises AD Migration

AZ-900 By islever Editorial Last updated

Describe Azure identity, access, and security

Short answer

A Syncing all the Active Directory user accounts to Azure Active Directory (Azure AD) reduces the effect on users by preserving their existing credentials and access patterns.

Question

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if
the solution satisfies the requirements.
Your company's Active Directory forest includes thousands of user accounts.
You have been informed that all network resources will be migrated to Azure. Thereafter, the on-premises data center will be retired.
You are required to employ a strategy that reduces the effect on users, once the planned migration has been completed.
Solution: You plan to sync all the Active Directory user accounts to Azure Active Directory (Azure AD).
Does the solution meet the goal?
  1. Yes Correct Answer
  2. No

Key Takeaways

The exam tests whether identity synchronization is the correct strategy to minimize user disruption when retiring on-premises servers in favor of cloud-only resources.

This question evaluates the use of Azure AD Connect to synchronize on-premises Active Directory identities to Azure AD, ensuring a seamless user experience during infrastructure migration. The solution meets the goal by allowing users to retain their existing credentials and access patterns.

Common mistake: Candidates often select 'No' because they associate identity sync with a hybrid model that requires keeping on-premises servers running. They fail to recognize that sync can be used as a migration tool before the on-premises environment is fully retired.

Expert Analysis

Why the Answer Is Correct

Syncing Active Directory accounts to Azure AD (typically via Azure AD Connect) creates synchronized identities in the cloud. This allows users to continue using their familiar on-premises usernames and passwords to access cloud resources immediately after the migration. By maintaining the same authentication mechanism, the impact on users is minimized, fulfilling the requirement to reduce disruption.

Why the Other Options Are Wrong

Selecting 'No' implies that syncing causes significant user impact or is technically invalid for this scenario. However, without sync (or password hash sync), users would need to change their login methods, causing high friction. The option assumes a strict separation between cloud and on-premises that contradicts the goal of a smooth transition.

Community Comment Notes

Community consensus strongly supports 'Yes'. As Rohitbmenon noted, "Azure AD is correct" for minimizing impact. AntonioTech explained that this approach ensures users "can continue using their existing... credentials." While some users like emptyH questioned if this constitutes a hybrid state, the key is that the sync enables the transition regardless of the final long-term architecture.

Exam Strategy

When asked about migrating from on-premises AD to Azure while minimizing user impact, prioritize solutions that preserve existing credentials and identity management practices, such as Azure AD Connect sync.

Frequently Asked Questions

Does syncing AD to Azure AD require keeping on-premises servers?

Not necessarily for the sync process itself, but Azure AD Connect typically runs on a server connected to the on-premises AD. You can sync accounts and then retire the on-premises infrastructure once the migration is complete.

Why is Azure AD Connect better than creating new accounts manually?

Manual creation leads to errors and forces users to learn new credentials. Sync ensures consistency, automation, and immediate access for thousands of users without disruption.

More AZ-900 FAQ →

Discussion 43 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 43

  1. Rohitbmenon 👍 36
    Azure AD is correct, the previous question on the same scenario should be a NO
  2. CassarJ 👍 26
    Answer is correct. It is beneficial to sync your on premise AD with the AD Azure to minimize the impact on users
  3. AntonioTech 👍 15
    The answer is A. Yes Syncing all the Active Directory user accounts to Azure Active Directory (Azure AD) is a common strategy to ensure a smooth migration to the cloud while minimizing the impact on users. This approach is often referred to as implementing a hybrid identity model. By syncing the user accounts to Azure AD using tools like Azure AD Connect, users can continue using their existing credentials to access cloud resources after the migration. This provides a seamless experience for users and reduces the disruption typically associated with migrations. Therefore, the solution of syncing Active Directory user accounts to Azure AD meets the goal of reducing the impact on users during the migration to Azure.
  4. RajaNarayanan 👍 11
    Sorry... Answer is YES
  5. BeauChateau 👍 9 Answered A
    Yes, the solution meets the goal. By syncing all the Active Directory user accounts to Azure AD, the users will be able to access their resources seamlessly after the migration without any major disruptions. This will reduce the impact of the migration on the users and minimize the need for them to change their existing login credentials.
Show 25 more comments
  1. RajaNarayanan 👍 8
    Answer is NO How can I connect Active Directory with Azure AD? Connecting Active Directory with Azure AD enables you to provide a consistent identity experience to your users. There are a few ways to connect your existing Active Directory installation with Azure AD. Perhaps the most popular method is to use Azure AD Connect. Azure AD Connect synchronizes user identities between on-premises Active Directory and Azure AD. Azure AD Connect synchronizes changes between both identity systems, so you can use features like SSO, multifactor authentication, and self-service password reset under both systems. Self-service password reset prevents users from using known compromised passwords.
  2. shadeey 👍 6
    well think about it, if you have 1000 employees and 500 of them suddenly cannot log their pcs? that s "impact" :)
  3. emptyH 👍 6 Answered A
    Yes. Pre-Sync those bad boys to AAD and enjoy the ride.
  4. n00bofn00bs 👍 5
    this should be no? if you sync the accounts, wont you be in hybrid mode? the plan is to retire onprem ad and leave it behind, and solely run off azure ad
  5. SiafSy 👍 4
    KeyWords: reduces the effect on users When you Sync AD to AAD user would not notice any changes. and as aerumna comennted you can later remove the AD.
  6. aerumna 👍 4
    I think that it means that you initially sync them into your AAD and then turnoff the on-prem active directory. Like you were "migrating" them.
  7. RajaNarayanan 👍 3
    What is Azure AD connect and how it works? Azure AD Connect is used to synchronize user accounts, group memberships, and credential hashes from an on-premises AD DS environment to Azure AD. ... For example, if a user changes their password using Azure AD self-service password management, the password is updated back in the on-premises AD DS environment. How synchronization works in Azure AD Domain Services | Microsoft ...
  8. c13bee8 👍 3 Answered A
    The answer is A. You're reducing the effect on users, syncing their existing AD accounts to Azure will reduce the impact vs having to rebuild new accounts. Remember AD accounts can include items such as group memberships, phone extensions, etc. so syncing all that data saves an extraordinary amount of time which will obviously reduce the impact vs not doing it at all.
  9. theakin 👍 3
    All users can be synced from on-premises to Azure AD using AD Connect. The answer is A
  10. dfb10222024 👍 3 Answered A
    Azure Active Directory (Azure AD) has been rebranded as Microsoft Entra ID
  11. Kanders 👍 3
    B. No - need to utilize AD Connect to Azure AD (and possibly AAD Hybrid)
  12. Amarzzz 👍 3
    Yes, correct answer is A, AD Sync
  13. gallard99 👍 3
    500 calls or tickets for IT :D
  14. Harshmr 👍 2 Answered A
    ✅ Explanation: Goal: Reduce the effect on users after migrating all network resources to Azure and retiring the on-premises data center. ✅ Proposed Solution: Sync all on-premises Active Directory user accounts to Azure Active Directory (Azure AD). This solution does meet the goal because: Azure AD Connect allows you to synchronize on-premises AD accounts to Azure AD. Users can continue using their existing usernames and passwords. This approach enables Single Sign-On (SSO) to cloud resources like Microsoft 365, Azure services, and other SaaS apps. It minimizes disruption to users by avoiding the need to recreate or reconfigure user identities.
  15. RajaNarayanan 👍 2
    What is Azure AD connect used for? Azure Active Directory (Azure AD) Connect Health provides robust monitoring of your on-premises identity infrastructure. It enables you to maintain a reliable connection to Microsoft 365 and Microsoft Online Services. This reliability is achieved by providing monitoring capabilities for your key identity components.3 days ago https://docs.microsoft.com › hybrid What is Azure AD Connect and Connect Health. | Microsoft Docs
  16. Rcosmos 👍 2 Answered B
    O que é uma floresta do Active Directory? Pensa numa árvore genealógica digital: A floresta é o conjunto completo — tipo a família inteira. Dentro dela, você tem domínios — como se fossem filiais ou departamentos. Cada domínio tem seus usuários, senhas, computadores e regras. Tudo isso funciona junto, mas com limites bem definidos. Quem está numa filial pode acessar o que precisa, mas não tudo — só o que foi autorizado.
  17. RahulKS 👍 2 Answered B
    Correct answer is B , No. Directory sync (e.g., with Azure AD Connect): Requires the on-prem AD to remain Users are still mastered on-prem If you shut down on-prem AD → identity breaks
  18. dksanf 👍 2
    using Azure AD is a common practice to ensure a smooth transition to cloud while minimizing impact on users
  19. Gagan29 👍 2
    AD connect helps in this On premises to Azure AD
  20. Nathi91061651 👍 2
    but what impact are they talking about?
  21. Tstar 👍 2
    A. Use Azure AD Connect to do this.
  22. Stephane_37 👍 2 Answered A
    A is correct
  23. Meesquared 👍 1 Answered A
    By syncing all on-premises AD user accounts to Azure AD (using Azure AD Connect), users can continue using the same usernames and passwords to access cloud resources. This minimizes the impact on users because they don’t need new credentials after migration. This is the correct approach when moving to Azure to ensure a hybrid identity during migration and a smooth transition. 👉 Therefore, the solution meets the goal. ✔️
  24. kahla 👍 1 Answered A
    Your company’s on-premises Active Directory (AD) forest has thousands of user accounts. All network resources will be migrated to Azure. The on-premises data center will be retired. You want to minimize the impact on users after migration.
  25. Didiclimb85 👍 1
    Esta pregunta parece desactualizada porque ya no se utiliza ese término, sino que se habla de ID... Esto podría llevar a confusión, ya que parece una trampa para ver si se conoce el término actual, ya sea AD o ID.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Resource Locks for RG Protection

S-grade

Shared Responsibility in Azure SaaS

S-grade

Accessing Azure Cloud Shell via Web Browser

S-grade

Azure VM High Availability SLA Requirements

S-grade

Practice All AZ-900 Questions

Access 90 questions with complete answers and detailed explanations.

View Full AZ-900 Practice Test →

← Back to AZ-900 Study Guide