If your users sign in to Microsoft 365 with accounts that come from on-premises Active Directory, your sign-ins depend on a sync server most people never look at. When it stops, nothing breaks immediately. Then a new hire cannot sign in, a password reset does not take effect, or a leaver stays enabled in the cloud. A regular hybrid identity health check catches these problems before users do. This guide covers what to check, where to look and how often.
How hybrid identity can fail quietly
Most hybrid tenants in the SMB space use Microsoft Entra Connect Sync (formerly Azure AD Connect) on a Windows server, or the lighter Microsoft Entra Cloud Sync agent. Either way, the sync engine reads changes from Active Directory and writes them to Microsoft Entra ID on a schedule, every 30 minutes by default for Connect Sync.
The failure modes I see most often:
The sync service has stopped after a server reboot, patch or expired service account password.
Password hash synchronization has stopped, so password changes on-premises do not reach the cloud, while everything else keeps syncing.
Object-level sync errors, such as duplicate proxy addresses or UPNs, block individual users from syncing.
The accidental delete threshold was hit and exports stopped completely, often after an OU move or filtering change.
The server is running an unsupported version of Entra Connect, or an outdated Windows Server.
Nobody receives the alert emails because they go to a former admin’s mailbox.
Where to check sync health
In the Microsoft Entra admin center
Go to Entra ID > Entra Connect. The overview shows the sync status, the last sync time, and whether password hash sync is enabled. If the last sync is more than an hour or two old, investigate.
Microsoft Entra Connect Health
Connect Health is the monitoring service for your on-premises identity components. With the Connect Health agent installed on each sync server, it gives you:
Active and resolved alerts, with remediation steps
An object-level sync error report, grouped into duplicate attribute, data mismatch, data validation failure, large attribute and other categories, updated every 30 minutes
Sync latency and object change trends
Email notifications when alerts are raised and resolved
Connect Health for sync requires Entra Connect Sync V2 and Microsoft Entra ID P1 or P2. Open it from the Entra admin center or at aka.ms/aadconnecthealth.
On the sync server itself
The Synchronization Service Manager shows each run profile and any errors per connector. For a quick status check in PowerShell on the server:
Get-ADSyncScheduler shows whether the scheduler is enabled, the next run time and whether staging mode is on. Start-ADSyncSyncCycle -PolicyType Delta triggers an immediate delta sync after you fix something.
A monthly hybrid identity health check
This is the checklist I run on hybrid tenants. It takes about 30 minutes once you know where everything is.
Check
Where
Healthy result
Last successful sync
Entra ID > Entra Connect
Within the last hour
Password hash sync heartbeat
Connect Health alerts
No “heartbeat skipped” or “stopped” alerts
Object sync errors
Connect Health > Sync errors
Zero, or a known, documented list
Scheduler status
Get-ADSyncScheduler
Enabled, not in staging mode on the active server
Entra Connect version
Server, compared to Microsoft’s version history
A currently supported version
Server OS and patching
Server
Supported Windows Server, patched
Accidental delete protection
Entra Connect configuration
Enabled with a sensible threshold
Alert recipients
Connect Health > Notification settings
Current admins and a shared mailbox
Sync service account
Active Directory
Not expired, not used for anything else
Record the result of each check with the date, even when everything is green. A simple log in a shared document or ticket gives you a baseline, shows auditors and insurers that the control is operating, and makes it obvious when something changes. If the sync error count was zero for six months and suddenly shows fifteen, you know where to start.
Pay attention to what users report as well. Tickets such as “my new password only works on my laptop”, “the new starter has no mailbox” or “I still see the old job title in Teams” are often the first visible sign of a sync problem. When two or three of these arrive in the same week, check sync health before treating each one as a separate issue.
Fixing the most common sync errors
Duplicate attribute
Two objects claim the same proxyAddresses or userPrincipalName. This often happens when a cloud-only account was created for a user before their on-premises account synced, or when an alias was reused. Connect Health shows the conflicting objects side by side, and for some cases offers a guided fix. Otherwise, remove the duplicate value from one object in AD or in the cloud, then run a delta sync.
Data validation failure
Invalid characters or formatting in critical attributes, such as a UPN with a space or an unverified domain suffix. Fix the value in Active Directory and let it sync.
Accidental delete threshold reached
Entra Connect blocks exports when more objects than the threshold are marked for deletion (500 by default). Do not just raise the threshold. First confirm why: a moved OU, a changed filter or a real cleanup. If the deletions are intended, allow them once. If not, fix the cause and the pending deletes disappear.
Password hash sync stopped
Restarting the Microsoft Entra ID Sync service during a quiet period usually restores it. If it keeps stopping, check connectivity from the server and the health of the domain controllers it reads from.
Reducing the risk long term
Treat the sync server as Tier 0. It holds credentials that can change identities in both directories. Restrict who can sign in to it, keep it patched, and protect it with Defender for Endpoint.
Run a staging server if your environment is large enough. A second Entra Connect server in staging mode can be promoted quickly if the primary fails.
Consider Cloud Sync for simpler environments. It uses lightweight agents, supports multiple agents for availability, and is managed from the cloud.
Keep break-glass accounts cloud-only so a sync failure can never lock you out of the tenant.
Plan your direction. Many SMBs are reducing their dependence on on-premises AD altogether. Our migration projects often start with exactly this health check.
The default delta sync interval for Entra Connect Sync is 30 minutes, which suits most businesses. You can trigger a manual delta sync with Start-ADSyncSyncCycle -PolicyType Delta when you need a change to appear sooner.
What happens to sign-ins if the sync server goes down?
With password hash synchronization, users can keep signing in with their existing passwords because authentication happens in the cloud. New accounts, password changes and attribute changes will not sync until the server is back. With pass-through authentication or federation, an outage can block sign-ins entirely.
Should I move from Entra Connect Sync to Cloud Sync?
For single-forest environments with simple requirements, Cloud Sync is often easier to run. Check Microsoft’s comparison of the two tools before switching, because some advanced Connect Sync features are not available in Cloud Sync.
Not sure when your sync server last worked cleanly? Book a free Microsoft 365 security assessment and we will include a hybrid identity health check in the review.
If your users sign in to Microsoft 365 with accounts that come from on-premises Active Directory, your sign-ins depend on a sync server most people never look at. When it stops, nothing breaks immediately. Then a new hire cannot sign in, a password reset does not take effect, or a leaver stays enabled in the cloud. A regular hybrid identity health check catches these problems before users do. This guide covers what to check, where to look and how often.
How hybrid identity can fail quietly
Most hybrid tenants in the SMB space use Microsoft Entra Connect Sync (formerly Azure AD Connect) on a Windows server, or the lighter Microsoft Entra Cloud Sync agent. Either way, the sync engine reads changes from Active Directory and writes them to Microsoft Entra ID on a schedule, every 30 minutes by default for Connect Sync.
The failure modes I see most often:
Where to check sync health
In the Microsoft Entra admin center
Go to
Entra ID > Entra Connect. The overview shows the sync status, the last sync time, and whether password hash sync is enabled. If the last sync is more than an hour or two old, investigate.Microsoft Entra Connect Health
Connect Health is the monitoring service for your on-premises identity components. With the Connect Health agent installed on each sync server, it gives you:
Connect Health for sync requires Entra Connect Sync V2 and Microsoft Entra ID P1 or P2. Open it from the Entra admin center or at
aka.ms/aadconnecthealth.On the sync server itself
The Synchronization Service Manager shows each run profile and any errors per connector. For a quick status check in PowerShell on the server:
Get-ADSyncSchedulershows whether the scheduler is enabled, the next run time and whether staging mode is on.Start-ADSyncSyncCycle -PolicyType Deltatriggers an immediate delta sync after you fix something.A monthly hybrid identity health check
This is the checklist I run on hybrid tenants. It takes about 30 minutes once you know where everything is.
Record the result of each check with the date, even when everything is green. A simple log in a shared document or ticket gives you a baseline, shows auditors and insurers that the control is operating, and makes it obvious when something changes. If the sync error count was zero for six months and suddenly shows fifteen, you know where to start.
Pay attention to what users report as well. Tickets such as “my new password only works on my laptop”, “the new starter has no mailbox” or “I still see the old job title in Teams” are often the first visible sign of a sync problem. When two or three of these arrive in the same week, check sync health before treating each one as a separate issue.
Fixing the most common sync errors
Duplicate attribute
Two objects claim the same
proxyAddressesoruserPrincipalName. This often happens when a cloud-only account was created for a user before their on-premises account synced, or when an alias was reused. Connect Health shows the conflicting objects side by side, and for some cases offers a guided fix. Otherwise, remove the duplicate value from one object in AD or in the cloud, then run a delta sync.Data validation failure
Invalid characters or formatting in critical attributes, such as a UPN with a space or an unverified domain suffix. Fix the value in Active Directory and let it sync.
Accidental delete threshold reached
Entra Connect blocks exports when more objects than the threshold are marked for deletion (500 by default). Do not just raise the threshold. First confirm why: a moved OU, a changed filter or a real cleanup. If the deletions are intended, allow them once. If not, fix the cause and the pending deletes disappear.
Password hash sync stopped
Restarting the Microsoft Entra ID Sync service during a quiet period usually restores it. If it keeps stopping, check connectivity from the server and the health of the domain controllers it reads from.
Reducing the risk long term
Microsoft’s guide to monitoring Entra Connect Sync with Connect Health explains every alert and report. If you would rather have someone else watch it, sync monitoring is part of our Microsoft 365 managed service.
Frequently asked questions
How often should Entra Connect sync?
The default delta sync interval for Entra Connect Sync is 30 minutes, which suits most businesses. You can trigger a manual delta sync with
Start-ADSyncSyncCycle -PolicyType Deltawhen you need a change to appear sooner.What happens to sign-ins if the sync server goes down?
With password hash synchronization, users can keep signing in with their existing passwords because authentication happens in the cloud. New accounts, password changes and attribute changes will not sync until the server is back. With pass-through authentication or federation, an outage can block sign-ins entirely.
Should I move from Entra Connect Sync to Cloud Sync?
For single-forest environments with simple requirements, Cloud Sync is often easier to run. Check Microsoft’s comparison of the two tools before switching, because some advanced Connect Sync features are not available in Cloud Sync.
Not sure when your sync server last worked cleanly? Book a free Microsoft 365 security assessment and we will include a hybrid identity health check in the review.