When directory synchronization breaks, the clue is a short string: an export error type in Synchronization Service Manager, an event ID in the Connect server's Application log, or a quarantine status in Cloud Sync. This quick reference covers 51 of them across Connect Sync exports, password hash sync, password writeback and Cloud Sync, with Microsoft's meaning, the usual cause and the first check.
Codes in this quick reference
InvalidHardMatch (103): the cloud user with privileged roles is not allowed to be taken overSynchronization Service Manager (export)AttributeUpdateNotAllowed (96): OnPremisesObjectIdentifier cannot be changed unless its current value is nullSynchronization Service Manager (export)Hard match operation blocked due to security hardeningSynchronization Service Manager (export)InvalidSoftMatch: soft match found an object with a different immutableIdSynchronization Service Manager (export)ObjectTypeMismatch: soft match found an object of a different typeSynchronization Service Manager (export)AttributeValueMustBeUnique: mail, proxyAddresses, signInName or UPN already used by another objectSynchronization Service Manager (export)IdentityDataValidationFailed / DataValidationFailed: data fails Entra ID validationSynchronization Service Manager (export)LargeObject / ExceededAllowedLength: object or attribute over the size, length or count limitSynchronization Service Manager (export)
+ 43 more codes in the tables below.
How to read these codes#
- Synchronization Service Manager on the Connect Sync server: the Operations tab shows each run's status; select an export run on the Microsoft Entra connector (named like
contoso.onmicrosoft.com - AAD) and open the object to see the error type and stack trace. - Connect Health sync errors report in the Microsoft Entra admin center: the same export errors with both conflicting objects, refreshed every 30 minutes.
- Application log on the Connect server: source Directory Synchronization for password hash sync, ADSync and PasswordResetService for password writeback.
- Object password sync log: Connectors › AD connector › Search Connector Space, open the user and select Log (seven days of results).
- Cloud Sync: Entra ID › Entra Connect › Cloud sync for agent and quarantine status, plus the provisioning logs.
PowerShell
Get-ADSyncScheduler # SyncCycleEnabled, StagingModeEnabled
Import-Module ADSyncDiagnostics
Invoke-ADSyncDiagnostics -PasswordSync # password hash sync health per connector
Get-WinEvent -FilterHashtable @{ LogName = 'Application'; ProviderName = 'Directory Synchronization'; Id = 611, 652, 655 } -MaxEvents 20
Start-ADSyncSyncCycle -PolicyType Delta # rerun after a fixExport errors (Connect Sync)#
Since July 1, 2026, Entra ID enforces hard match security hardening automatically, so expect the first three whenever a match targets a protected cloud account. Fix data in the source directory, not in the cloud.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
InvalidHardMatch (103) | The cloud user with privileged roles is not allowed to be taken over | Target holds or is eligible for a privileged role, or the tenant blocks takeover by hard match | Remove the role or eligibility, let the match complete, restore it. Guide |
AttributeUpdateNotAllowed (96) | OnPremisesObjectIdentifier cannot be changed unless its current value is null | The cloud user is already mapped to another on-premises object | Clear onPremisesObjectIdentifier (Graph or ADSyncTools), then sync |
| Hard match operation blocked due to security hardening | The hard match hit the 2026 security hardening | Privileged, eligible or already mapped target | Review the OnPremisesObjectIdentifier mapping; allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled only temporarily |
InvalidSoftMatch | No hard match; soft match hit an object with a different immutableId | Duplicate proxyAddresses or UPN, recreated object, forest move, new sourceAnchor after reinstall | Find both objects in Connect Health; remove the duplicate at the source |
ObjectTypeMismatch | Soft match hit a user, group or contact of another type | A cloud mail-enabled group already uses the new user's address | Remove the address from the object that shouldn't have it |
AttributeValueMustBeUnique | mail, proxyAddresses, signInName or UPN already in use | Duplicate value added to an already synced object | Decide which object keeps it; fix the other |
IdentityDataValidationFailed / DataValidationFailed | Data fails Entra ID validation | Unsupported characters or format in the UPN; a hard match changing onPremisesObjectIdentifier | Correct the UPN in Active Directory |
LargeObject / ExceededAllowedLength | Object or attribute over the size, length or count limit | Over 15 userCertificate or userSMIMECertificate values, big thumbnailPhoto, too many proxyAddresses | Delete expired certificates and stale X.400, X.500, MSMail or CcMail addresses; plan for about 300 addresses |
| Existing Admin Role Conflict | Soft match to a cloud user with an admin role isn't allowed | On-premises user has the same UPN as a cloud admin | Remove the roles, hard-delete the quarantined object, sync, restore roles |
DeletingCloudOnlyObjectNotAllowed (Error Type 114, 0x8023134a) | This synchronization operation, Delete, isn't valid. Contact Technical Support. | Deleting a restored, unsynced or out-of-scope object, often in a hybrid-to-cloud-only move | Soft-delete the cloud account, delta sync, restore it from the recycle bin, delta sync |
| Password access violation | The password change request can't be executed because it contains changes to one or more cloud-only user objects (or: one or more cloud-only users' credential update is included in the current request) | Back-end calls trying to change cloud-only objects, which Entra ID protects | Manage cloud-only accounts in the cloud |
Run statuses and Connect Health alerts#
A status beginning with stopped- means the run ended early; completed-export-errors means it finished but some objects failed.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
completed-export-errors | Export finished; some objects rejected | Any export error above | Open the run, then each object's error |
stopped-deletion-threshold-exceeded | Export stopped: more deletes pending than allowed (500 by default) | OU unselected or renamed, objects moved out of scope, filter change | Search Connector Space › Pending Export › Delete; fix scope, or lift the threshold for one export if every delete is intended. Guide |
| Export to Microsoft Entra ID was Stopped. Accidental delete threshold was reached | Connect Health alert for the same condition | As above | Review pending deletes before anything else. Guide |
| Health Service data is not up to date | Connect Health agent stopped reporting | Agent services stopped, proxy change, blocked endpoints | Test-MicrosoftEntraConnectHealthConnectivity -Role Sync |
Password hash synchronization#
Application log, source Directory Synchronization#
Microsoft treats 611, 652 and 655 as signs of a connectivity problem; the message names the affected forest.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
611 | Error during password hash sync for a domain | Domain or DC unreachable, connector account permissions | Replicate Directory Changes and Replicate Directory Changes All on each domain root |
652 | Error during password hash sync operation | Connectivity | Invoke-ADSyncDiagnostics -PasswordSync |
655 | Error during password hash sync ping | Connectivity | Same, plus outbound access to Entra ID |
654 missing | No heartbeat: 654 is logged every 30 minutes per connector when idle | Staging mode, feature disabled, channel down | Diagnostics; if still no heartbeat, trigger a full password sync once |
656 / 657 | Password hash sync request and response messages | Normal batch activity | For one user, read the response, then the object's log |
613 | Paused because directory full sync hasn't completed | New install or full sync running | Let the cycle finish |
616 | Connection to preferred DC failed | Unreachable DC in the preferred list | Fix Configure Directory Partitions, restart ADSync |
621 | Full password hash sync attempt failed | Given in the event details | Correlate with 611 or 652, then run diagnostics |
Object password sync log and alerts#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
FilteredByTarget | Password set to User must change password at next logon; not synced | Temporary password | User changes it, or use Connect 2.0.3.0 or later with ForcePasswordChangeOnLogon enabled |
NoTargetConnection | No object in the metaverse or Entra connector space | Filtered or never provisioned | Filtering, cloudFiltered, lineage |
TargetNotExportedToDirectory | Entra connector space object not yet exported | Pending export or an export error | The object's export error |
| Password Hash Synchronization has stopped working | Connect Health alert | Sync service, connectivity, active server switched to staging | Diagnostics. Guide |
Password writeback#
ADSync and sync engine errors#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
6329 0x80230619 | A restriction prevents the password from being changed to the current one specified | Minimum age, history, complexity, password filter or PASSWD_CANT_CHANGE | Another password; minimum age 0 for tests. Guide |
6329 | The server doesn't contain the LDAP password policy control | LDAP_SERVER_POLICY_HINTS_OID unavailable | Use DCs on Windows Server 2016 or later |
6329 0x8023061f | Password synchronization isn't enabled on this Management Agent | Forest added after writeback was enabled | Disable and re-enable writeback |
6800 | Writeback endpoint didn't start | Onboarding or endpoint startup failure | PasswordResetService events, restart ADSync |
hr=800700CE | The filename or extension is too long | AD DS connector account password over 256 characters | Shorten it, update the connector credentials |
hr=80230402 | Duplicated entries with the same anchor | Same user enabled in several forests, or non-unique anchor | Remove duplicates; use a unique anchor |
PasswordResetService events#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
31003 / 31008 | PasswordResetFail / ChangePasswordFail | Domain policy, missing permissions, protected group | Policy, then ADMA permissions. Guide |
31016 | WriteBackServiceStopped: cloud requests fail | Service didn't restart | Restart ADSync; re-enable writeback |
31034 | ServiceBusListenerError | Firewall; "The remote certificate is invalid" means missing root CAs | Test-NetConnection to the namespace in the event, port 443 |
32002 | Error Connecting to ServiceBus. The token provider was unable to provide a security token. | Outbound firewall rule | Allow *.servicebus.windows.net, *.passwordreset.microsoftonline.com |
32009 | AuthTokenError: Error getting auth token. | Wrong password or federated Hybrid Administrator in setup | Rerun with a managed admin account |
33001 | ADUnKnownError from Active Directory | Also reserved characters in the OU path | ADSync events; OU names |
33002 | ADUserNotFoundError | Deleted on-premises only, or sync problem | Recent sync run details |
33003 | ADMutliMatchError: two users share the cloud anchor | Duplicate anchor values | Remove the duplicate |
33004 | ADPermissionsError | No Reset password permission, or AdminCount = 1 | Permissions on all objects |
33005 / 33006 | Account disabled / locked out on-premises | Account state | Enable or unlock, retry |
33008 | ADPasswordPolicyError | Age, history, complexity or filter | New password |
SSPR_0029 | We are unable to reset your password due to an error in your on-premises configuration. | Management agent denied access | Allow the MSOL_ account in Network access: Restrict clients allowed to make remote calls to SAM |
Cloud Sync#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
| Quarantine | Job quarantined after calls to the target fail consistently | For example, invalid admin credentials | Select the status for the error code; fix it, then Clear quarantine or Restart sync |
AzureDirectoryServiceAuthorizationFailed | Quarantine: authorization failed | Service principal Microsoft Entra AD Synchronization Service missing | Set onPremisesSyncEnabled to true on the organization with Graph to recreate it; allow up to 24 hours |
| Service 'Microsoft Entra Provisioning Agent' failed to start. | Agent service can't start | Group Policy blocked rights for NT SERVICE\AADConnectProvisioningAgent | Fix the policy; Learn's workaround changes the service logon account |
| Agent times out or certificate isn't valid | Registration can't reach the service | Proxy required | Proxy settings in AADConnectProvisioningAgent.exe.config |
| Skipped | Object out of scope; identity shows only a Source ID | Scoping, or critical system objects | Search the provisioning logs by ObjectGuid |
| Deletes blocked | Directory's accidental deletion prevention stops exports | Connect Sync and Cloud Sync on one tenant | Confirm the deletes, then Disable-AADCloudSyncToolsDirSyncAccidentalDeletionPrevention. Guide |
How to verify a fix#
- Run
Start-ADSyncSyncCycle -PolicyType Delta(orInitialafter scope or rule changes): both connectors showsuccessand the object is gone from the Connect Health report within 30 minutes. - Password hash sync: each connector logs
654every 30 minutes, the diagnostics come back clean, and a test change produces656and657. - Writeback: a pilot reset logs
31001then31002, and the user signs in on-premises with the new password. - Cloud Sync: the agent is active, no quarantine, and the provisioning logs show success for the object.
References#
- Understanding errors during Microsoft Entra synchronization (Microsoft Learn)
- Troubleshoot password hash synchronization with Microsoft Entra Connect Sync (Microsoft Learn)
- Troubleshoot self-service password reset writeback (Microsoft Learn)
- Cloud sync troubleshooting (Microsoft Learn)
- Microsoft Entra Connect Sync: Prevent accidental deletes (Microsoft Learn)
