The pre-flight checks with their expected silence, the second controller then the last with the right flags, the insurance image, the tenant-side cleanup in order, and the stale-device sweep with the warning that saves a machine's recovery keys. The commands for the one stage that does not undo.
The last stage, and the one with a point of no return. An observation window and a scream test, the order of operations, the things that fail silently on their own schedule, and the go or no-go a consultant would actually sign. The build sheet handles the commands; this article handles the judgment.
Before you power anything off, one more census. The domain controllers carry quiet jobs that have nothing to do with logins: DNS, DHCP, time, the identity detection surface, the last stragglers still speaking old protocols. Stage 5 is the readiness check that stops a premature power-off.
Every zero-AD project meets one application that refuses to leave the directory. Stage 4 is a ladder you work down in order: replace it, re-authenticate it, isolate it, or keep a directory and admit what that costs. Microsoft's own migration guide is missing the rung that actually removes the dependency.
Stage 3 is where the services move. The file server becomes a set of destinations rather than a swap, print and certificates each get a directory-free replacement, and the Wi-Fi runs into the one gap Microsoft never filled. Mostly this article points at the series that already own the details.
There is no supported way to convert a hybrid-joined laptop to Entra join without a reset, and Microsoft says so plainly. Stage 2 stops looking for the shortcut that does not exist and spends its effort making the rebuild cheap: what carries over, what does not, and the one thing you deploy before the first device moves.
The pilot-wave method for the one-way door: transfer a handful of users to cloud-managed, verify, then cut the sync for the tenant and clean up what lingers. Rollback shown where it genuinely exists, and the point of no return named plainly.
Stage 1 is the one-way door. Converting synced users to cloud-managed is now a supported, reversible, per-user operation, which means you can rehearse the irreversible step on three people before you commit a hundred and forty. What changes, what lingers, and the version cliff the sync engine has waiting for you.
