We have been running Azure AD Connect on an old server for years to sync our on-premises AD with Microsoft 365, and it still works. Microsoft keeps nudging us that the version is outdated and should move to Microsoft Entra Connect. The server is also on an old Windows Server build. What is the safest way to upgrade without breaking sync for everyone, and can I just run the new installer over the top of the old one?
How to Upgrade Old Azure AD Connect to Microsoft Entra Connect
Resolved
Cloud
CM
Community Member August 17, 2026
6 replies
1,622 views
Reviewed by moderators
6 Answers
Short version: Azure AD Connect and Microsoft Entra Connect are the same product, Microsoft just renamed it, so "upgrading to Entra Connect" means moving to the current version. There are three supported ways to do it, and which one is safe for you depends mostly on how far behind you are and whether you also need a newer operating system.
The three methods are automatic upgrade, in-place upgrade, and swing migration. Given your server is old and on an outdated Windows build, the swing migration is almost certainly the right call, more on why below.
Quick rundown of the three so you can see where you fit:
Automatic upgrade: if you did an Express installation, minor version bumps can install themselves. Easiest, but only for small hops and it often does not fire on its own, so people end up upgrading manually anyway.
In-place upgrade: run the new installer on the same server, over the existing install. Fine for a reasonably current single server. It is not supported coming from the very old DirSync or Azure AD Sync tools, those require a swing.
Swing migration: stand up a brand new server with the current OS and Entra Connect, import your existing config, verify it in staging mode, then switch over. It is the most conservative and lowest-risk method.
For your situation the answer is a swing migration, and here is the reasoning. Microsoft's own guidance is that anyone who has not upgraded in roughly 12 to 18 months should swing rather than upgrade in place, because old production servers accumulate patches and quirks that cannot all be accounted for. Just as important, you want a newer Windows Server, and you should never do an in-place OS upgrade under a sync server, it frequently breaks sync and resets custom rules. A swing gives you a clean, current OS and a rollback path if anything looks wrong.
The swing migration flow, at a high level:
1. On the old server, open Entra Connect and use View or export current configuration to save the settings (a JSON file). 2. Build a new server (Server 2016 or later for V2) and install the current Microsoft Entra Connect on it. 3. During setup, import the exported configuration so all your sync rules and options carry over. 4. On the last screen, enable staging mode so the new server reads and prepares but does not write to the cloud yet. 5. Let it run and verify the staged server's pending exports match what you expect.
Then the actual cutover, which is just flipping which server is live:
Put the old server into staging mode, and take the new server out of staging mode so it becomes the active sync server. Because only one Entra Connect server can actively sync at a time, this hand-off is what makes the switch clean. Confirm a sync cycle completes and objects are flowing from the new server. Keep the old server around in staging for a little while as a fallback, then once you are confident, uninstall Entra Connect from it or retire the box.
Two practical warnings. First, if you customized the out-of-box synchronization rules on the old server, document them before you start, imported config usually carries them but you want a record in case anything reverts to default. Second, the very first sync on the new server can take a while on large directories, which is another reason staging mode matters, the old server keeps syncing normally the whole time so users never lose the same-login experience. Do the cutover in a quiet window and you will have zero downtime.