Entra Connect staging-mode switch-over checklist

Before you start

• A domain-joined Windows Server with the full GUI, protected as a Tier 0 (control plane) asset.
• The current Connect Sync build, downloaded from the Manage tab of Entra ID › Entra Connect › Get started. Version guidance is in my Connect Sync upgrade guide.
• A Hybrid Identity Administrator account assigned directly (not through a group), plus Enterprise Admin credentials or a pre-created AD DS connector account for each forest.

Checklist

1. 1

   Capture the active server's configuration

   Every change made through the Connect wizard drops a time-stamped Applied-SynchronizationPolicy-*.json file into %ProgramData%\AADConnect.

2. 2

   Build the staging server from the export

   • Run the installer, select Customize, tick Import synchronization settings and browse to the JSON file.
   • Supply credentials for each forest. You can't add or remove directories during an import; do that later in the wizard.
   • Keep the same user sign-in option as the active server. With pass-through authentication this is critical: choosing a different option on a new server disables PTA for the whole tenant.
   • On the last page staging mode is already selected for imported settings. Leave Start the synchronization process when configuration completes ticked.

   Afterwards, export the new server's configuration and compare both JSON files in a side-by-side diff tool. The only differences should be ones you expect, such as the server name or service account.

3. 3

   Prove what the staging server would export

   Run a full cycle on the staging server (nothing is exported, so it's safe), then dump the pending exports for the Microsoft Entra connector:

   powershell

   Import-Module ADSync
   Get-ADSyncScheduler | Select-Object SyncCycleEnabled, StagingModeEnabled
   Start-ADSyncSyncCycle -PolicyType Initial
   Get-ADSyncConnector | Select-Object Name

   cmd

   cd /d "%ProgramFiles%\Microsoft Azure AD Sync\bin"
   REM Use the exact name of your Microsoft Entra connector from Get-ADSyncConnector
   csexport "contoso.com - Microsoft Entra ID" %temp%\export.xml /f:x
   CSExportAnalyzer %temp%\export.xml > %temp%\export.csv

4. 4

   Switch the active server

   • Confirm the staging server has its scheduler enabled, has synced recently, and that accidental-delete protection is on (Get-ADSyncExportDeletionThreshold).
   • On the current active server, open Microsoft Entra Connect, choose Configure staging mode, sign in as a Hybrid Identity Administrator, tick staging mode, keep synchronization enabled and select Configure. Get-ADSyncScheduler should now show StagingModeEnabled : True. If that server is dead rather than healthy, shut it down or isolate it so it can't come back and export.
   • On the staging server, run Configure staging mode, clear the checkbox, choose to start synchronization and select Configure.
   • Watch the next cycle in Synchronization Service Manager: Export steps should now complete against the Microsoft Entra connector.

   In a swing upgrade, the old server then becomes the new staging server (upgrade it next) or is fully uninstalled. Don't leave an old server switched off "just in case": started later with stale data and expired credentials, it can revert attribute values in Microsoft Entra ID every cycle.

5. 5

   Disaster recovery choices

   Strategy	Recovery	Notes
   Rebuild when needed	Install plus initial sync, typically hours	Objects re-match on sourceAnchor; you need your configuration export
   Standby server in staging mode	Minutes after switching	Recommended for larger or complex environments
   Virtual machine on another host	Depends on your virtualization platform	Supported; still only one exporting server

   If you use a full SQL Server instead of LocalDB, SQL clustering and Always On availability groups are supported for high availability; database mirroring isn't.

Verify

• Run Get-ADSyncScheduler on every sync server: exactly one should report StagingModeEnabled : False.
• Change a harmless attribute on a test user, such as job title, run Start-ADSyncSyncCycle -PolicyType Delta on the new active server and confirm the value in Microsoft Entra ID.
• Check password hash sync catch-up in the Application log: events 654 and 656 show batch progress and 657 shows per-user success. Then test a password change.

Note: Password sync resumes from its last watermark, so a server that sat in staging mode for a long time may need hours to catch up. Don't restart the sync service during catch-up; it can restart from an earlier watermark.

Tips & gotchas

• While the Connect wizard is open, sync engine operations are suspended. Close it as soon as you're done.
• The Seamless SSO Kerberos key rollover is done from the active server; it isn't needed on staging servers. See my Seamless SSO troubleshooting guide.
• If password writeback misbehaves after a switch, check that no other server is still active, then use my SSPR and writeback checklist.
• Filtering changes deserve the same staging treatment — see filtering without deleting users.
• Planning a rebuild anyway? Check whether Cloud Sync fits your scenario first.