We run an on-premises Active Directory domain in the office and we have just moved to Microsoft 365 for email and Office apps. Right now staff have two separate logins, one for their office computer and a different one for Microsoft 365, which is confusing everyone. I want them to use the same username and password for both. I gather this is called a hybrid setup and needs some kind of sync tool. How do I actually connect our on-prem AD to Office 365, and are there any prerequisites I will trip over?
How to Sync On-Premises Active Directory to Office 365 for a Hybrid Setup
Resolved
Cloud
CM
Community Member August 14, 2026
6 replies
1,025 views
Reviewed by moderators
6 Answers
What you want is hybrid identity, and the tool that does it is Microsoft Entra Connect (this is the current name for what used to be called Azure AD Connect, which itself replaced the older DirSync and Azure AD Sync tools). It is a free download that runs on an on-premises server and synchronizes your AD users, groups and contacts up to the Microsoft Entra tenant behind your Microsoft 365 subscription. Once it is running, people sign in to both their office PC and Microsoft 365 with the same on-premises username and password.
You install it on a domain-joined Windows Server, point it at your AD, authenticate to your tenant, and let it sync. The heavy lifting is in the prerequisites, get those right and the wizard itself is straightforward.
Before you install anything, sort out the domain name, this is where most people trip. Your on-premises AD user accounts need a UPN suffix that matches a verified public domain in your tenant. If your internal AD domain is something like company.local, that is not routable and will not match, so you cannot sync those users as-is.
The fix: first verify your real domain (for example company.com) in the Microsoft 365 admin center, then in your AD server open Active Directory Domains and Trusts, add company.com as an alternative UPN suffix, and set each user's logon name to use it. Now the on-prem UPN matches the cloud domain and sync will line up the accounts correctly.
Rest of the prerequisites to have ready:
A Microsoft Entra tenant (you already have one via Microsoft 365). A Windows Server to run Entra Connect, domain-joined, meeting the current hardware and .NET requirements. Two accounts: a Microsoft 365 account with the Hybrid Identity Administrator role, and an on-premises AD domain (enterprise) admin account, the installer uses the latter to create its own service account. And DNS/firewall: the server must resolve both your internal AD and the Microsoft Entra endpoints, and reach Microsoft 365 URLs through any proxy or firewall.
Next decide the authentication method, the wizard asks this and it matters:
Password Hash Synchronization is the recommended path for most organizations. A hash of the on-prem password hash is synced to the cloud so users sign in directly against Entra ID with the same password. Simple and resilient. Pass-through Authentication validates the password against your on-prem AD in real time, nothing password-related is stored in the cloud. Federation (AD FS) is the heavyweight option, only needed for specific requirements like third-party MFA or existing federation. For a straightforward "same login everywhere" goal, choose Password Hash Sync.
Now the install itself. Download Microsoft Entra Connect onto that server and run it. Choose Express settings for the recommended defaults, or Custom if you need to pick the sign-in method and organizational units to sync. When prompted, sign in with your Hybrid Identity Administrator cloud account, then connect your on-prem forest with an enterprise admin account so it can create its sync service account. Confirm the sign-in (UPN) configuration screen shows your verified domain, that screen is the one people rush and regret. Finish the wizard and it performs the first synchronization.
You can also flip the switch from the cloud side and confirm it is working: in the Microsoft 365 admin center go to Users, Active users, then the three-dot More menu and Directory synchronization to see status. After the first sync, your on-prem users appear in Microsoft 365 as synced accounts (they show a different icon from cloud-only users). Assign them licenses and they are ready.
One ongoing point to remember: once sync is on, Active Directory becomes the source of truth. You manage those users on-premises (names, group membership, disabling leavers) and the changes flow up on the next sync cycle, which runs about every 30 minutes by default. Editing a synced user directly in the cloud is blocked for most attributes.