Docs

Appearance

Entra Connect Operations ​

Overview ​

Entra Connect (formerly Azure AD Connect) is the sync engine between on-premises Active Directory (ciriusgroup.internal) and Entra ID (the cloud identity layer). It runs on the Primary DC or a dedicated sync server in the production environment.

What it syncs:

  • User accounts (on-prem AD → Entra ID)
  • Group memberships
  • Password hash sync (enables Entra authentication using on-prem passwords)
  • Device objects

Sync direction: On-premises AD is the source of truth. Changes in on-prem AD replicate to Entra ID. Changes made directly in Entra ID may be overwritten on the next sync cycle if they conflict with on-prem attributes.

Default sync cycle: Every 30 minutes (delta sync).

Checking Sync Health ​

Quick Status Check ​

Run on the Entra Connect server (Primary DC or sync server):

powershell
Import-Module ADSync
Get-ADSyncScheduler

Key fields to check:

  • SyncCycleEnabled — should be True
  • NextSyncCyclePolicyType — Delta (normal) or Initial (full sync running)
  • NextSyncCycleStartTimeInUTC — when the next scheduled sync runs

Recent Sync Results ​

powershell
# Last sync run details
Get-ADSyncConnectorRunStatus

Shows the last run for each connector (AD connector and Entra ID connector). Look for:

  • Result — success is expected; anything else needs investigation
  • StartDate and EndDate — verify a sync completed within the last 30 minutes

Entra ID Portal — Sync Status ​

Entra ID → Entra Connect → Sync status

Shows:

  • Last sync time (should be within 30 minutes)
  • Object counts (users synced, errors)
  • Current sync errors

If the "Last sync" timestamp is more than 1 hour old, the sync cycle has stalled.

Triggering a Manual Sync ​

Force an immediate sync without waiting for the 30-minute cycle:

powershell
# Delta sync — only changed objects (fast, ~1-5 minutes)
Start-ADSyncSyncCycle -PolicyType Delta

# Full sync — all objects (slow, use only when delta isn't picking up a change)
Start-ADSyncSyncCycle -PolicyType Initial

Run these on the Entra Connect server. Use delta sync for normal operations. Full sync (Initial) causes extra load and is only needed after a schema change or connector reconfiguration.

Common trigger scenarios:

  • Created a user in AD and need them in Entra immediately
  • Added a user to a group and the cloud-side resource needs it now
  • Completed an offboarding and want the Entra disable to propagate immediately

Viewing Sync Errors ​

Via PowerShell ​

powershell
# View objects that failed to sync
Get-ADSyncCSObject -ConnectorName "ciriusgroup.internal" -ErrorsOnly

Each error shows the object, the error type, and the error message.

Via Entra Portal ​

Entra ID → Entra Connect → Sync errors

Common sync errors:

ErrorCauseFix
AttributeValueMustBeUniqueDuplicate UPN or ProxyAddress between two objectsFind the duplicate, rename one
InvalidSoftMatchEntra has a cloud-only object with the same email — can't auto-mergeHard-match the objects using ImmutableId
ExportedEntryTooLargeObject has too many group memberships or proxy addressesReduce the attributes on the object
ObjectTypeMismatchObject type in AD doesn't match what's in EntraCheck if the object was manually created in Entra first
PasswordPolicyViolationOn-prem password doesn't meet Entra password policyUsually self-resolves on next password change

For sync errors that persist more than 24 hours: investigate and fix. Unresolved errors mean those users/groups are not syncing.

Common Operations ​

Force-Sync a Single Object ​

After modifying a specific user or group in AD and needing it in Entra immediately:

powershell
# Sync a specific user
$dn = (Get-ADUser -Identity "username").DistinguishedName
Invoke-ADSyncRunProfile -ConnectorName "ciriusgroup.internal" -RunProfileName "Delta Import"
Start-ADSyncSyncCycle -PolicyType Delta

The delta sync picks up all changes since the last sync — you can't target a single object, but running a delta sync immediately after the change achieves the same effect.

Checking What Will Sync (Staging Mode) ​

Entra Connect can run in staging mode — it performs syncs but doesn't write to Entra ID. Useful for verifying a config change before applying it to production.

powershell
# Check if staging mode is enabled
Get-ADSyncGlobalSettings | Select StagingModeEnabled

If staging mode is enabled unexpectedly, disable it to restore normal sync: Entra Connect wizard → Configure staging mode → uncheck → Apply

Monitoring the Sync Service ​

Application Event Log ​

On the Entra Connect server:

powershell
# Recent Entra Connect events (EventSource = "Directory Synchronization")
Get-WinEvent -LogName Application | Where-Object { $_.ProviderName -like "*ADSync*" } |
  Select-Object TimeCreated, LevelDisplayName, Message | Select-Object -First 20

Warning/Error events here mean the sync engine encountered a problem. Check the message for specifics.

Sync Service Manager (GUI) ​

On the Entra Connect server:

%ProgramFiles%\Microsoft Azure AD Sync\UIShell\miisclient.exe

Or search: Synchronization Service Manager

Shows the visual history of all connector runs — green = success, red = error. Click any run to see the detail including which objects changed.

If Entra Connect Stops Syncing ​

Step 1 — Check the Service ​

powershell
Get-Service "ADSync"

If the service is stopped, start it:

powershell
Start-Service "ADSync"

Wait 2 minutes, then trigger a delta sync and verify it completes.

Step 2 — Check Event Logs ​

powershell
Get-WinEvent -LogName Application -MaxEvents 50 |
  Where-Object { $_.LevelDisplayName -in "Error","Warning" -and $_.ProviderName -like "*ADSync*" } |
  Select-Object TimeCreated, Message

Look for authentication errors, connectivity failures, or disk space issues.

Step 3 — Check Connectivity ​

Entra Connect must reach:

  • On-prem AD (LDAP to the DC — should always work if on the same network)
  • Entra ID endpoints (outbound HTTPS — requires internet access)

Test Entra connectivity:

powershell
Test-NetConnection -ComputerName login.microsoftonline.com -Port 443

If this fails, a firewall rule or proxy configuration is blocking outbound HTTPS from the sync server.

Step 4 — Credential Refresh ​

Entra Connect authenticates to Entra ID using a service account. If the service account password expired or the account was disabled:

powershell
# Update Entra Connect credentials via wizard
%ProgramFiles%\Microsoft Azure AD Sync\Bin\miiserver.exe

Or rerun the Entra Connect configuration wizard → Change user sign-in → re-enter the service account credentials.

Step 5 — Escalate to Kevin/Greg ​

If the Entra Connect server itself is unhealthy (OS-level issues, disk failure, domain connectivity problems), escalate to Kevin or Greg — they manage the DC infrastructure.

Disaster Recovery — Entra Connect Server Down ​

If the Entra Connect server is permanently unavailable (server failure, ransomware, Azure VM deleted):

  1. Users don't immediately lose access — Entra ID caches synced attributes. Existing sessions continue. New logins using password hash sync continue for 72 hours (after which, authentication falls back to cloud-only if available)

  2. Deploy Entra Connect on another DC — install Entra Connect on the RODC or the DR DC using the same service account and configuration. Run in staging mode first to verify it picks up the correct objects before enabling production sync.

  3. Disable the old server in Entra if it appears as a registered device — Entra ID → Entra Connect → Registered devices — remove the stale registration

  4. The full Entra Connect installation guide is at: docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-install-express

Document History ​

DateChangeAuthor
May 2026Initial draft — sync health checks, manual sync trigger, sync error types and fixes, service monitoring, troubleshooting stopped sync, DR for Connect server outage.Rory

Internal use only — Cirius Group