Closing a datacenter is a cost decision before it is a technical one. Ours was a colocation site, space we rented in someone else’s building, and it had changed hands several times over the years. Each new owner brought a new pricing structure, and the cost of staying there was climbing fast enough that keeping our hardware in that room had stopped making sense.

Synchronizing Entra users with VMware SAML authentication was a challenge I knew I had to solve. The traditional approach required deploying an on-premises SCIM solution or connecting vCenter directly to Entra, both of which introduced unnecessary complexity and potential security risks. I wanted something simpler, more efficient, and secure. That’s where the idea for the PowerShell Entra Sync Agent was born.

This tool was designed to bridge the gap between Entra and VMware without relying on SCIM or direct connectivity. By leveraging the Microsoft Graph API and the vCenter API, I created a lightweight solution that dynamically synchronizes users from a specified Entra group to VMware SAML authentication. It’s a solution that not only simplifies the process but also enhances security and scalability.

Over about five years I ran multiple rounds of VMware host replacement and vSphere upgrades across our multi-site environment, and I did all of it during normal business hours with zero impact to the workloads running on top. Each round covered roughly 10 to 25 hosts at a time, full hardware refreshes, major-version ESXi and vCenter upgrades, and SAN refreshes running in parallel.