> ## Documentation Index
> Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Migrate a client to Entra

> Keep a client synced while new starters are created in Entra only, so onboarding goes cloud-first and offboarding still reaches the accounts left in Active Directory.

While a client moves from on-premises Active Directory to Microsoft Entra, it has both kinds of account: existing staff synced from AD, and new starters that should only ever exist in Entra. Core handles this without a special mode. Keep the client synced, and add a User Onboarding rule that creates new accounts in Entra only. It needs the [desktop agent](https://kb.mspprocess.com/desktop-agent/overview.md) on the client, as any synced client does.

## Set it up

**1. Keep the client synced**

Go to **Clients**, open the client and check Environment type is Cloud + On-Prem (synced). Leave it that way until the last AD account has gone.

Every workflow that changes an existing account looks at that account, not the client: an AD-synced account goes through the desktop agent, a cloud-only one through Microsoft 365. So User Offboarding, Re-enable Terminated Account, Password Reset, Account Unlock and Change User Details keep working for both kinds of staff throughout the move.

**2. Add a rule that creates new starters in Entra**

Go to **Config > User Onboarding**, pick the client, and under Conditional rules click **Add rule**. Give it a condition every new starter meets, such as First name · is not empty, and set **Create in** to **Entra only**. Save.

New starters are now created in Entra, with the base access and the rule's groups, mailboxes and licences. The rule's OU and AD groups are ignored for an account created in Entra only.

**3. Finish the migration**

Once every account is in Entra and Microsoft Entra Connect is retired, set Environment type to Cloud Only, remove the rule and uninstall the agent.

> [!TIP]
>
> To move only some teams first, give the rule a narrower condition, such as Department · is Sales, and leave everyone else on the client default. The last matching rule decides where an account is created.

## Troubleshooting

> [accordion] Create in isn't on the rule
>
> It only appears for a Cloud + On-Prem (synced) client. Check the client's Environment type.

> [accordion] A new starter was still created in AD
>
> Either the rule's condition didn't match their request, or a later rule matched with Create in set to On-prem AD + sync. The last matching rule wins, so put the Entra only rule last, or widen its condition.

## Related

* [Configure User Onboarding](https://kb.mspprocess.com/core/get-started/configure-user-onboarding.md)
* [User Onboarding](https://kb.mspprocess.com/core/workflows/user-onboarding.md)
* [Add your clients](https://kb.mspprocess.com/core/get-started/add-your-clients.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.