Disable Active Directory synchronization in Microsoft Entra ID

Introduction

When an organization moves from hybrid identity to cloud-only identity, one key task is turning off on-premises directory synchronization in Microsoft Entra ID.

This guide covers a practical process using Microsoft Graph PowerShell, including verification steps and important timing considerations.

Before you begin

Confirm these prerequisites:

• You have a Global Administrator account.
• You understand your current sync architecture (Entra Connect Sync and/or Cloud Sync).
• You have a rollback/communication plan.
• You have tested sign-in impact on a pilot group.

Important:

• Disabling sync can take time to fully apply.
• The disable operation is not an instant toggle.
• Re-enabling later may trigger a full sync cycle.

Step 1: Install Microsoft Graph PowerShell

Run PowerShell as administrator:

Install-Module Microsoft.Graph -Force

If already installed, update to latest:

Update-Module Microsoft.Graph

Step 2: Connect to Microsoft Graph

Connect with the required permissions:

Connect-MgGraph -Scopes "Organization.ReadWrite.All"

You can verify the session:

Get-MgContext

Step 3: Check current on-premises sync status

Inspect tenant status:

Get-MgOrganization | Select-Object DisplayName, OnPremisesSyncEnabled

If OnPremisesSyncEnabled is True, directory synchronization is currently enabled.

Step 4: Disable on-premises directory synchronization

Run:

$orgId = (Get-MgOrganization).Id

$params = @{
  onPremisesSyncEnabled = $false
}

Update-MgOrganization -OrganizationId $orgId -BodyParameter $params

Notes:

• Microsoft may take up to 72 hours to fully process deactivation depending on object volume.
• During this period, allow the operation to complete before attempting further identity topology changes.

Step 5: Verify synchronization is disabled

Re-check status:

Get-MgOrganization | Select-Object DisplayName, OnPremisesSyncEnabled

Expected outcome:

• OnPremisesSyncEnabled is blank (null) or no longer True.

Also validate in admin portals:

• Entra admin center
• Microsoft 365 admin center

Operational checks after disablement

Run post-change validation:

• Test sign-in for admin and standard users.
• Confirm password reset behavior for formerly synced accounts.
• Validate Exchange/Teams/SharePoint access for pilot users.
• Confirm critical groups and memberships still meet access requirements.

If you used on-premises distribution groups or hybrid mail patterns, review these objects explicitly and recreate cloud-native equivalents where required.

Common pitfalls

Disabling sync without understanding current topology

If multiple sync methods or forests are involved, plan dependency impact first.

Assuming all synced object types convert identically

Users and some group types can behave differently from mail/distribution constructs. Validate object classes before and after change.

No communication plan

Even when technically successful, user experience issues (sign-in prompts, app token refresh) can generate support noise without advance notice.

Conclusion

Disabling Active Directory synchronization in Microsoft Entra ID is straightforward from a command perspective, but operational success depends on planning, validation, and staged execution.

Use Microsoft Graph cmdlets to confirm current state, disable safely, and verify completion before making further identity architecture changes.