How to Cut Over from Hybrid AD to Microsoft Entra ID (Australian Walk-through)

The answer in fifty-five words

A hybrid Active Directory to Microsoft Entra ID cutover is a multi-quarter programme bounded by your legacy application portfolio, not by Entra readiness. The technical order is: retire ADFS, simplify AD Connect, prepare devices for Entra join with Cloud Trust, migrate workloads off Kerberos dependencies, and only then retire AD Connect and the last on-premises domain controller.

Why cutover order matters

Australian organisations move to Microsoft Entra ID to remove the on-premises identity footprint — fewer domain controllers, fewer privileged access workstations to manage, fewer forest recovery rehearsals to run. The wrong order multiplies risk. Retiring AD Connect before workloads are off Kerberos breaks user sign-in. Retiring ADFS without preparing Conditional Access policies breaks federated access. Retiring the last domain controller before the certificate authority moves breaks every certificate-bound system.

Microsoft's Hybrid Identity Documentation (Microsoft Learn, current) is explicit about the recommended order. The Australian-specific pitfalls — Privacy Act 1988 (Office of the Australian Information Commissioner — Privacy Act 1988, accessed 16 June 2026) obligations to maintain access controls during migration, ASD ISM (Australian Signals Directorate — Information Security Manual, accessed 16 June 2026) auditing requirements that span the cutover period, and Essential Eight ML2 (Australian Signals Directorate — Essential Eight Maturity Model, accessed 16 June 2026) commitments that continue to apply during the cutover — sharpen the order further.

Step 1 — Inventory what holds the on-premises forest in place

Begin with a directory-dependency inventory. The list usually has four categories:

• User sign-in dependencies — laptops on Windows 11 joined to AD, ADFS federations, Kerberos-bound legacy applications.
• Service identity dependencies — service accounts in Domain Admins or with delegated rights on file servers, SQL Servers using Windows authentication, applications using LDAP or LDAPS to AD.
• Certificate dependencies — servers issued certificates by an AD-integrated certificate authority.
• Group policy dependencies — GPOs that configure Windows behaviour, drive maps, printer mappings, software deployments.

For each item, ask: does this need to stay where it is, can it move to Entra-native, or can it be retired? The cutover plan is the answer for every line.

Step 2 — Retire ADFS first

Microsoft has been pushing ADFS retirement since 2020. Pass-through Authentication or Password Hash Synchronisation moves user authentication into Entra ID without the federation server. Conditional Access in Entra replaces the access policies previously enforced at ADFS.

The retirement order:

1. Enable Password Hash Synchronisation in AD Connect as a fallback (sign-in continues if PTA agents are unavailable).
2. Migrate ADFS-federated applications to direct Entra ID single sign-on application by application. Microsoft Entra Application Gallery covers the major SaaS catalogue.
3. Move the remaining custom federations to Microsoft Entra Application Proxy or Microsoft Entra Private Access where the application cannot be modified.
4. Cut sign-in over from ADFS to Pass-through Authentication or Password Hash Sync. The cutover is a single PowerShell command (Set-MsolDomainAuthentication -DomainName ... -Authentication Managed).
5. Decommission ADFS servers.

Conditional Access policies and named locations replace the ADFS claim rules. Test each migrated application end-to-end with a representative user before retirement.

Step 3 — Prepare devices for Entra join

The user device estate moves from hybrid-joined (AD-joined and Entra-registered) to Entra-joined. Microsoft Intune is the management plane.

• New devices: Autopilot Entra-joined from procurement onwards. The image is unmanaged on receipt; Autopilot provisions, joins, and enrols in Intune in the first sign-in.
• Existing devices: re-enrol via Autopilot reset or run side-by-side migrations using Microsoft's Entra-join migration toolkit.
• Authentication: Windows Hello for Business with Cloud Trust. Cloud Trust (Microsoft Learn, 2025) allows the device to obtain a partial TGT from Entra ID for sign-in even when on-premises domain controllers are unreachable — useful both for resilience and as a stepping stone away from on-premises Kerberos.

ACSC Hardening Microsoft Windows 10 and Windows 11 Workstations (November 2025 ISM bundle) controls apply to Entra-joined devices identically.

Step 4 — Migrate workloads off Kerberos

This is the longest phase. For each Kerberos-bound workload, the choice is one of:

• Move to SaaS — replace the on-premises application with a SaaS equivalent that supports Entra ID single sign-on.
• Move to Entra-joined IaaS — for applications that must run in the organisation's compute, lift to Azure with Entra ID-only authentication using Microsoft Entra Domain Services or Entra-joined Windows Server with Cloud Trust.
• Front with Entra Application Proxy or Private Access — for applications that cannot be modified, publish them via Entra Application Proxy with Conditional Access. The application still uses Kerberos behind the proxy via Kerberos Constrained Delegation, but the user surface is Entra-native.
• Retire — applications that have outlived their business case go.

File services are usually the slowest migrators because of the volume of unstructured data. The 2026 pattern is to move to SharePoint Online with sensitivity labels under Microsoft Purview, then retire the on-premises file server.

Step 5 — Simplify AD Connect

AD Connect is the last on-premises identity component. As workloads retire, simplify it:

• Remove sync scopes for OUs that no longer contain in-use objects.
• Reduce attribute flow to the minimum required.
• Disable group writeback if no longer used.
• Monitor sync health into Microsoft Sentinel with alerting on unexpected deletions.

Throughout this phase the AD forest is still alive. Tier 0 discipline, Essential Eight ML2 backup of System State, and forest recovery rehearsal cadence all continue to apply.

Step 6 — Cut over

When the last Kerberos-bound workload has retired and AD Connect is syncing only what Entra strictly needs, the actual cutover is short:

1. Stop sync from AD Connect (set Set-ADSyncScheduler -SyncCycleEnabled $false).
2. Convert the remaining synced objects to cloud-only via the documented Microsoft procedure (Convert-MsolFederatedUser and friends, or the staged rollout tooling).
3. Uninstall AD Connect.
4. Demote the remaining domain controllers, leaving the last one to be powered off after a quiescence window.
5. Decommission the AD-integrated certificate authority after migrating any certificate-bound services.

The forest is now retired. Microsoft Entra ID is the sole identity provider.

Step 7 — Confirm resilience controls survived

Cloud-only is not a free pass on resilience. Confirm:

• Conditional Access policies are in place for every privileged role and every internet-facing application.
• Privileged Identity Management is enabled for every Tier 0 cloud role.
• Microsoft Entra ID Protection and Microsoft Defender for Identity (or its Entra-only equivalent) are deployed and monitored.
• Break-glass accounts are documented, tested, and excluded from policies that could lock them out.
• Backups of Microsoft 365 data (mailboxes, SharePoint, OneDrive) are configured against a third-party or Microsoft 365 Backup service. Microsoft does not back up tenant data against ransomware-grade scenarios by default.
• The Tier 0 register is updated — the on-premises assets come off, the cloud assets stay on.

ASD Essential Eight Maturity Level 2 requirements continue to apply to the cloud-only environment. The controls move but the bar does not.

Common Australian failure modes

• Retiring ADFS without finishing application migration. Users lose access to a federated SaaS application on Monday morning. Always finish per-application migration before cutting ADFS.
• Forgetting the certificate authority. Web servers, RDP gateways, and 802.1X-authenticated devices all break when the AD-integrated CA disappears without a replacement.
• Assuming Entra ID is a backup. Mass deletions sync through. Configure a third-party backup or Microsoft 365 Backup before cutover.
• Leaving service accounts in Domain Admins. Service accounts that survive the cutover by being re-pointed at Microsoft Entra service principals should never have held Domain Admin in the first place. Audit before migration, not after.

Where to go next

• Pillar guide: AD tier model and Essential Eight ML2 recovery.
• The named risks programme this guide assumes: Hybrid AD to Entra cutover risk register.
• Baseline your posture: the Active Directory Security and Resilience Assessment.
• Practitioner-led deep dive: the paid Active Directory Resilience Review.

Sources cited

• Microsoft. Hybrid Identity Documentation. Microsoft Learn, current.
• Microsoft. Plan your hybrid Active Directory sign-in. Microsoft Learn, 2025.
• Microsoft. Windows Hello for Business Cloud Trust. Microsoft Learn, 2025.
• Microsoft. Decommission AD FS. Microsoft Learn, 2025.
• Microsoft. Microsoft Entra Application Proxy / Private Access. Microsoft Learn, current.
• ACSC. Hardening Microsoft Windows 10 and Windows 11 Workstations. November 2025 ISM bundle.
• ASD. Essential Eight Maturity Model. Current 2025 revision.
• ASD. Information Security Manual. November 2025 release.

Sources referenced in this article: Privacy Act 1988, ASD Essential Eight Maturity Model, ASD Information Security Manual (ISM), Microsoft Hybrid Identity Documentation, Microsoft Plan your hybrid Active Directory sign-in, Microsoft Windows Hello for Business Cloud Trust, Microsoft Decommission AD FS, Microsoft Entra Application Proxy / Private Access, ACSC Hardening Microsoft Windows 10 and Windows 11 Workstations.