Entra Connect Sync vs Cloud Sync (and PHS vs PTA)
Verdict: Choose Cloud Sync for its 2-minute cloud-managed cadence and lightweight agents. Choose Connect Sync when the estate exceeds the bundled 100,000-object store and needs a full on-premises sync engine. PTA authenticates on-premises; PHS syncs the hash.
| Criterion | Entra Connect Sync | Entra Cloud Sync |
|---|---|---|
| Sync cadence | 30-minute scheduler by default | Cloud-managed scheduler, every 2 minutes |
| Where the engine runs | On-premises server you install, patch and size | Cloud-managed scheduler driven by a provisioning agent |
| Backing store | Bundled SQL Express LocalDB, 10 GB, about 100,000 objects; external SQL above that | No local SQL database to size |
Rules
- Connect Sync's bundled SQL Express LocalDB caps at about 100,000 objects (10 GB); above that, point the wizard at a full SQL Server.
- The Connect Sync host must be a domain-joined, full-GUI Windows Server querying a writable domain controller; Server Core, RODC and Azure SQL are not supported.
- Both PHS and PTA support alternate-ID sign-in, and Conditional Access including Microsoft Entra MFA works with PTA.
- PTA validates credentials on-premises and does not store password hashes in the cloud; it is free, not a P1-licensed feature.
Traps
- A 90-second lag on Cloud Sync is one normal 2-minute cycle, not the 30-minute Connect Sync cadence; do not restart the agent.
- PTA does not store a salted hash in Entra ID and is not a paid P1 feature; those are PHS and licensing misconceptions.