Set it up
1
Keep the client synced
Go to Clients, open the client and check Environment type is Cloud + On-Prem (synced). Leave it that way until the last AD account has gone.Every workflow that changes an existing account looks at that account, not the client: an AD-synced account goes through the desktop agent, a cloud-only one through Microsoft 365. So User Offboarding, Re-enable Terminated Account, Password Reset, Account Unlock and Change User Details keep working for both kinds of staff throughout the move.
2
Add a rule that creates new starters in Entra
Go to Config > User Onboarding, pick the client, and under Conditional rules click Add rule. Give it a condition every new starter meets, such as First name · is not empty, and set Create in to Entra only. Save.New starters are now created in Entra, with the base access and the rule’s groups, mailboxes and licences. The rule’s OU and AD groups are ignored for an account created in Entra only.
3
Finish the migration
Once every account is in Entra and Microsoft Entra Connect is retired, set Environment type to Cloud Only, remove the rule and uninstall the agent.
Troubleshooting
Create in isn't on the rule
Create in isn't on the rule
It only appears for a Cloud + On-Prem (synced) client. Check the client’s Environment type.
A new starter was still created in AD
A new starter was still created in AD
Either the rule’s condition didn’t match their request, or a later rule matched with Create in set to On-prem AD + sync. The last matching rule wins, so put the Entra only rule last, or widen its condition.

