How to Disable Active Directory Synchronization in Microsoft Entra ID

First, install the Microsoft Graph PowerShell SDK, which replaced the legacy Azure AD modules. This is your primary tool for managing Microsoft Entra ID synchronization settings.

Install-Module Microsoft.Graph -Scope CurrentUser -Force

If you encounter execution policy issues, temporarily allow script execution:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Get-Module Microsoft.Graph -ListAvailable | Select-Object Name, Version

Connect to Microsoft Graph with the necessary permissions to modify organization settings. The Organization.ReadWrite.All scope is required to disable synchronization.

Connect-MgGraph -Scopes "Organization.ReadWrite.All"

This will open a browser window for authentication. Sign in with your Global Administrator or Hybrid Identity Administrator account. After successful authentication, you'll see a confirmation message in PowerShell.

Get-MgContext | Select-Object Account, Scopes

Before making changes, document the current synchronization state. This helps you understand what's currently enabled and provides a baseline for verification.

Get-MgOrganization | Select-Object DisplayName, OnPremisesSyncEnabled, OnPremisesLastSyncDateTime, OnPremisesDomainName

The output shows:

• OnPremisesSyncEnabled: Should be True if sync is active
• OnPremisesLastSyncDateTime: Timestamp of last successful sync
• OnPremisesDomainName: Your on-premises domain being synced

Also check which sync features are currently enabled:

Get-MgOrganization | Select-Object OnPremisesPasswordSyncEnabled, OnPremisesPassthroughAuthenticationEnabled

If your Microsoft Entra Connect server is still online and accessible, stop the synchronization scheduler first. This prevents new sync cycles from starting while you're disabling the feature.

On the Microsoft Entra Connect server, open PowerShell as Administrator and run:

Import-Module ADSync
Set-ADSyncScheduler -SyncCycleEnabled $false

Check that no synchronization is currently running:

Get-ADSyncScheduler

The output should show SyncCycleEnabled: False and SyncCycleInProgress: False.

If your on-premises environment is offline or decommissioned: Skip this step entirely. You can disable synchronization from the cloud side without on-premises access.

Now disable synchronization at the tenant level using Microsoft Graph. This is the critical step that tells Microsoft Entra ID to stop expecting synchronization from on-premises.

Update-MgOrganization -OnPremisesSyncEnabled $false

Alternatively, you can use the more explicit method:

$org = Get-MgOrganization
$org.OnPremisesSyncEnabled = $false
Update-MgOrganization -OrganizationId $org.Id -OnPremisesSyncEnabled $false

The command should complete without errors. If successful, you won't see any output, which is normal for Graph PowerShell commands.

Get-MgOrganization | Select-Object DisplayName, OnPremisesSyncEnabled, OnPremisesLastSyncDateTime

You should see OnPremisesSyncEnabled: False.

The disable process can take up to 72 hours to fully propagate through Microsoft's systems. Monitor the status regularly during this period.

Check the current status:

Get-MgOrganization | Select-Object OnPremisesSyncEnabled, OnPremisesLastSyncDateTime

Also verify in the Microsoft Entra admin center:

1. Navigate to https://entra.microsoft.com
2. Go to Identity > Hybrid management > Microsoft Entra Connect
3. Check that the sync status shows as disabled

Monitor for the next 72 hours. The portal may show conflicting information initially, but PowerShell provides the authoritative status.

Get-Date; Get-MgOrganization | Select-Object OnPremisesSyncEnabled

If you have access to the Microsoft Entra Connect server and no longer need it, uninstall the software to complete the cleanup process.

On the Microsoft Entra Connect server:

1. Open Programs and Features from Control Panel
2. Find Microsoft Entra Connect or Azure AD Connect
3. Right-click and select Uninstall
4. Follow the uninstall wizard

Alternatively, use PowerShell (if available):

Uninstall-MicrosoftEntraConnect

After uninstalling, restart the server to ensure all services are properly stopped.

If using Microsoft Entra Cloud Sync: Uninstall the provisioning agent from each server where it's installed.

Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*Entra*" -or $_.Name -like "*Azure AD*"}

This should return no results if the uninstall was successful.

With synchronization disabled, all user and group management must now be done directly in Microsoft Entra ID. Update your administrative processes accordingly.

Check for users that were previously synced and are now cloud-managed:

Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "userType eq 'Member'" -Property DisplayName,UserPrincipalName,OnPremisesImmutableId | Where-Object {$_.OnPremisesImmutableId -ne $null} | Select-Object DisplayName,UserPrincipalName

Review and update dynamic groups that may have relied on on-premises attributes:

Get-MgGroup -Filter "groupTypes/any(c:c eq 'DynamicMembership')" -Property DisplayName,MembershipRule

Update any dynamic group rules that reference on-premises attributes (like extensionAttribute1) to use cloud-based attributes instead.

Key changes to implement:

• Create new users directly in Microsoft Entra ID
• Manage group memberships through the cloud
• Update any automation scripts to use Microsoft Graph instead of on-premises AD
• Reconfigure any applications that relied on on-premises group memberships

$newUser = @{
    DisplayName = "Test User"
    UserPrincipalName = "testuser@yourdomain.com"
    MailNickname = "testuser"
    PasswordProfile = @{
        Password = "TempPassword123!"
        ForceChangePasswordNextSignIn = $true
    }
    AccountEnabled = $true
}
New-MgUser @newUser