--- title: "Scheduling the Entra ID Connector in a Hybrid Environment" canonical: "https://docs.certero.com/space/CUP/326238257/Scheduling%20the%20Entra%20ID%20Connector%20in%20a%20Hybrid%20Environment" format: markdown --- --- ## Overview This article applies to **hybrid deployments**, those running both an Active Directory connector and an Entra ID connector. If you run only one of the two, no special scheduling is required. --- ## Why Scheduling matters in a Hybrid Environment Both connectors write to the same underlying user and device records. Which source wins for a given user is governed by your **Preferred Directory Source** setting, and that arbitration is applied by each connector as it runs. Two behaviours make run timing significant: - **The connectors should not run at the same time.** Overlapping runs write to the same tables concurrently, which can slow both runs and produce inconsistent intermediate results. - **For device extension attributes, the connector that runs last takes effect.** Unlike user data, device extension attributes are not governed by the Preferred Directory Source setting. Whichever connector ran most recently supplies the values held against the device. --- ## Recommended Approach **Schedule the connectors sequentially, with a clear gap between them.** 1. Establish how long each connector takes to complete by reviewing the Results tab on each. Use the longest recent run rather than the average. 2. Schedule the second connector to start well after the first is expected to finish. A gap of at least the longest observed run duration is a reasonable starting point. 3. Review the timings again after the first few weeks. Run duration grows as your estate grows, and a gap that was comfortable at go-live can close over time. > ℹ️ **If you manage device extension attributes in Active Directory, schedule the Active Directory connector to run last.** This ensures Active Directory values are the ones held against your devices. If you manage them in Entra, schedule the Entra ID connector last. --- ## Example A customer whose Active Directory connector takes around 40 minutes and whose Entra ID connector takes around 25 minutes, and who maintains extension attributes in Active Directory, might schedule: | **Time** | **Connector** | | --- | --- | | 01:00 | Entra ID connector starts, completes around 01:25 | | 02:00 | Active Directory connector starts, completes around 02:40 | The Active Directory connector runs last, so Active Directory extension attribute values are the ones retained. The gap between them is comfortably longer than either run. --- ## Setting the Schedule Each connector's schedule is configured on the **Schedule** tab of its properties. See *[Creating an Entra ID Connector](https://docs.certero.com/space/CUP/317915138/Creating+an+Entra+ID+Connector)* for the Entra connector setup process. --- ## Related Considerations - **Set your Preferred Directory Source before the first Entra connector run**, not after. The setting governs which source wins on write, so a first run performed before the choice is made will already have applied the default. See *[Setting your Preferred Directory Source](https://docs.certero.com/space/CUP/326336556/Setting+your+Preferred+Directory+Source)**.* - **Offboarding depends on both sources being consistent.** A user removed from one directory but not the other can produce a temporarily incorrect status between runs. See *[Off-boarding users | Hybrid Active Directory and Entra ID Environment](https://helpdesk.certero.com/space/KCS/326172753/Off-boarding+Users+%7C+Hybrid+Active+Directory+and+Entra+ID+Environment)*. --- ## Getting Started / Support If you have questions or need help, please contact the **Certero Help Desk** or your Certero account team. --- © 2026 Certero Company Confidential. All rights reserved.