Microsoft Entra Connect staging mode: swing migrations, disaster recovery and safe upgrades

A second Microsoft Entra Connect Sync server in staging mode is cheap insurance: it lets you test configuration changes, replace or upgrade the sync server without a big-bang cut-over, and take over quickly if the active server dies. In this post I'll walk through what staging mode really does, how to build a staging server from an exported configuration, how to prove what it would export, and how to switch roles cleanly.

How staging mode works#

A staging server runs the full sync engine with its own database. It imports from Active Directory and Microsoft Entra ID and evaluates every sync rule, but it exports nothing to either directory, and password hash synchronization and password writeback stay inactive until staging mode is turned off. Because it keeps importing, it stays current; because it never writes, it's a safe place to preview a new configuration or version.

• Active-passive only. Exactly one server may export at any time, and only one server can use password writeback.
• Nothing replicates between servers. A filtering or sync rule change on the active server must be repeated on the staging server by you.

Prerequisites#

• A domain-joined Windows Server with the full GUI, protected as a Tier 0 (control plane) asset.
• The current Connect Sync build, downloaded from the Manage tab of Entra ID › Entra Connect › Get started. Version guidance is in my Connect Sync upgrade guide.
• A Hybrid Identity Administrator account assigned directly (not through a group), plus Enterprise Admin credentials or a pre-created AD DS connector account for each forest.

Step 1: Capture the active server's configuration#

Every change made through the Connect wizard drops a time-stamped Applied-SynchronizationPolicy-*.json file into %ProgramData%\AADConnect. Changes made in PowerShell, Synchronization Service Manager or the Synchronization Rules Editor are not captured automatically, so take a fresh export: open Microsoft Entra Connect, choose View or export current configuration and export the settings. Keep a copy off the server — it doubles as your rebuild kit.

Note what the import won't apply for you: device writeback, object types or attributes deselected in Synchronization Service Manager, custom run profiles, and custom rules whose precedence sits outside the reserved 0–99 range. To move an individual custom rule, select it in the Synchronization Rules Editor and choose Export; you get a PowerShell script to run on the new server once you replace the connector GUID with the new server's value.

Step 2: Build the staging server from the export#

1. Run the installer, select Customize, tick Import synchronization settings and browse to the JSON file.
2. Supply credentials for each forest. You can't add or remove directories during an import; do that later in the wizard.
3. Keep the same user sign-in option as the active server. With pass-through authentication this is critical: choosing a different option on a new server disables PTA for the whole tenant.
4. On the last page staging mode is already selected for imported settings. Leave Start the synchronization process when configuration completes ticked.

Afterwards, export the new server's configuration and compare both JSON files in a side-by-side diff tool. The only differences should be ones you expect, such as the server name or service account.

Step 3: Prove what the staging server would export#

Run a full cycle on the staging server (nothing is exported, so it's safe), then dump the pending exports for the Microsoft Entra connector:

Import-Module ADSync
Get-ADSyncScheduler | Select-Object SyncCycleEnabled, StagingModeEnabled
Start-ADSyncSyncCycle -PolicyType Initial
Get-ADSyncConnector | Select-Object Name

cd /d "%ProgramFiles%\Microsoft Azure AD Sync\bin"
REM Use the exact name of your Microsoft Entra connector from Get-ADSyncConnector
csexport "contoso.com - Microsoft Entra ID" %temp%\export.xml /f:x
CSExportAnalyzer %temp%\export.xml > %temp%\export.csv

What good looks like: export.csv is empty or holds a short list of changes you can explain. Filter the OMODT column (object modification type) for deletes first. For large files, Microsoft's csanalyzer.ps1 script on the staging-server page maps each DN to a UPN and display name. For a quick visual check, open Synchronization Service Manager, select the Microsoft Entra connector, choose Search Connector Space, set the scope to Pending Export and tick Delete. Fix anything unexpected and repeat until the pending exports are boring.

Step 4: Switch the active server#

1. Confirm the staging server has its scheduler enabled, has synced recently, and that accidental-delete protection is on (Get-ADSyncExportDeletionThreshold).
2. On the current active server, open Microsoft Entra Connect, choose Configure staging mode, sign in as a Hybrid Identity Administrator, tick staging mode, keep synchronization enabled and select Configure. Get-ADSyncScheduler should now show StagingModeEnabled : True. If that server is dead rather than healthy, shut it down or isolate it so it can't come back and export.
3. On the staging server, run Configure staging mode, clear the checkbox, choose to start synchronization and select Configure.
4. Watch the next cycle in Synchronization Service Manager: Export steps should now complete against the Microsoft Entra connector.

In a swing upgrade, the old server then becomes the new staging server (upgrade it next) or is fully uninstalled. Don't leave an old server switched off "just in case": started later with stale data and expired credentials, it can revert attribute values in Microsoft Entra ID every cycle.

Disaster recovery choices#

If you use a full SQL Server instead of LocalDB, SQL clustering and Always On availability groups are supported for high availability; database mirroring isn't.

Verify#

• Run Get-ADSyncScheduler on every sync server: exactly one should report StagingModeEnabled : False.
• Change a harmless attribute on a test user, such as job title, run Start-ADSyncSyncCycle -PolicyType Delta on the new active server and confirm the value in Microsoft Entra ID.
• Check password hash sync catch-up in the Application log: events 654 and 656 show batch progress and 657 shows per-user success. Then test a password change.

Tips and gotchas#

• While the Connect wizard is open, sync engine operations are suspended. Close it as soon as you're done.
• The Seamless SSO Kerberos key rollover is done from the active server; it isn't needed on staging servers. See my Seamless SSO troubleshooting guide.
• If password writeback misbehaves after a switch, check that no other server is still active, then use my SSPR and writeback checklist.
• Filtering changes deserve the same staging treatment — see filtering without deleting users.
• Planning a rebuild anyway? Check whether Cloud Sync fits your scenario first.

References#

• Microsoft Entra Connect: Staging server and disaster recovery
• Import and export Microsoft Entra Connect configuration settings
• Microsoft Entra Connect: Upgrade from a previous version to the latest