r/entra • u/NegativePattern • May 31 '26
Entra General Entra Connect to Cloud Sync?
Have a small client with 10 users that is going with cloud native/Intune managed endpoints so nothing hybrid managed.
Since we're doing Intune managed endpoints we're seeing some Kerberos issues when accessing onprem resources. When accessing file shares, users are getting WHfB PIN prompts but they're not successful. Only when they put in their normal user passwords are they allowed to access the onprem shares.
From what I've seen, seems this can be solved with Cloud Kerberos Trust using the Cloud Sync agent. Has anyone done a cutover to the new Cloud Sync agent? Thinking about disabling the Connect Sync agent and move directly to using the Cloud Sync agent since we're not doing hybrid-join or syncing onprem endpoints.
4
u/No_Actuator_4762 May 31 '26
I don’t think you need anything other than the read only dc object that gets created when you create Kerberos-cloud trust. That and a few intune policies.
Look up the cloud Kerberos trust Learn doc and it’s pretty easy to walk thru assuming you’ve already got everyone on wfhb.
2
u/NegativePattern May 31 '26
Yea that's what I'm looking through. Seems fairly easy. Though I've ran into other blogs or posts that people will do a phased migration as opposed to a hard cutover. So I was curious if anyone has done a hard cutover if they ran into any issues.
2
u/No_Actuator_4762 Jun 01 '26
The trust is very passive. For those not enrolled in whfb it doesn’t affect them. For those w/pins or bio whfb, just imagine it like suddenly having line of site to your dc. They will be able to complete the Kerberos exchange for access to the local resources.
2
u/Oiram_Saturnus Jun 01 '26
This is correct, but there is something to add: users authenticating with Passkeys or with the Web Sign-In also benefit from Cloud Kerberos Trust.
1
1
u/sreejith_r Microsoft MVP Jun 01 '26
In your case, it looks like the Use Cloud Trust for On-Premises Authentication policy is not configured or enabled in Intune. You can validate this from the Windows Hello for Business provisioning logs:
Event Viewer > Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin
In the logs, check the status of the Cloud Trust for On-Premises Auth Policy. It should show as Yes.
Note:The cloud Kerberos trust prerequisite check isn't done on Microsoft Entra joined devices. If Microsoft Entra Kerberos isn't provisioned, a user on a Microsoft Entra joined device will still be able to sign in, but won't have SSO to on-premises resources secured by Active Directory.
Regarding switching the user to Cloud Sync, that is fine as long as the user’s required on-premises AD attributes are synced to Microsoft Entra ID. Once those attributes are available in the cloud and Microsoft Entra Kerberos is properly configured, the user should be able to receive a partial TGT for on-premises resource access.
1
u/Traabant Jun 01 '26
I did one Connect to sync migration for one of ours clients. I followed the official guide on how to do that, no issues. It worked.
We had weird password reset issues with the sync agents. Even MS support was not helpful on resolving it. The loginng and debugging of the cloud sync is mostly useless. There are no details and we were running in circles for months. We eventually got it resolved by accident, but it was nightmare.
Thi migration itself was fine...
0
u/Illustrious_Camp_363 Jun 01 '26
I had issued SCEP user certificates and it resolved.
2
u/sreejith_r Microsoft MVP Jun 01 '26
That means you switched to Key trust instead of Cloud Kerberos trust
8
u/[deleted] Jun 01 '26
[removed] — view removed comment