Keeping Microsoft Entra Connect Sync supported: versions, auto-upgrade, in-place upgrades

Microsoft Entra Connect Sync is easy to forget once it works, but every 2.x build has a support clock, and Microsoft has now added a hard deadline on top of it. In this post I'll explain how versions retire, why auto-upgrade isn't a patching plan, and how to run an in-place or swing upgrade and check that everything still works afterwards.

How support works#

Since 15 March 2023, each 2.x build retires 12 months after a newer build is released, and no 1.x build synchronizes any more. Separately, a back-end security change meant servers below 2.5.79.0 fail to synchronize after 30 September 2026. If a server has recently stopped exporting, check its version first. Current support dates:

Watch for the trap: 2.6.3.0 is supported until July 2027 but doesn't meet the April 2027 requirement. Your real deadline is the application-based authentication requirement, not the support date.

Prerequisites and pre-flight checks#

• Windows Server 2016 or later, .NET Framework 4.7.2 or later, and TLS 1.2.
• Local administrator rights on the server and a Hybrid Identity Administrator account. Since 2.6.91.0, the wizard's sign-in also accepts passkeys and FIDO2 security keys.
• The installer, which is only available in the Microsoft Entra admin center: Entra ID › Entra Connect › Get started, Manage tab.
• A fresh configuration export (View or export current configuration in the wizard) and exports of any custom sync rules.

# Installed Connect Sync build
(Get-Item "$env:ProgramFiles\Microsoft Azure AD Sync\Bin\miiserver.exe").VersionInfo.ProductVersion
# .NET Framework 4.7.2 or later (Release 461808 or higher)
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full').Release -ge 461808
# Has a hardening baseline disabled TLS 1.2? (no output = OS default, which is enabled)
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -ErrorAction SilentlyContinue |
    Select-Object Enabled, DisabledByDefault
Get-ADSyncAutoUpgrade
Get-ADSyncScheduler | Select-Object SyncCycleEnabled, StagingModeEnabled

Auto-upgrade: a safety net, not a plan#

Get-ADSyncAutoUpgrade returns Enabled, Disabled or Suspended. Only the system sets Suspended, when the server isn't eligible. To switch between Enabled and Disabled, use Set-ADSyncAutoUpgrade -AutoUpgradeState Enabled (or Disabled). Leave it enabled, but don't depend on it:

• Microsoft only pushes some releases through auto-upgrade, typically those with critical fixes. In the release notes as of October 2026, 2.6.3.0 was the last auto-upgrade build, and 2.6.84.0, 2.6.91.0 and 2.6.92.0 are download-only.
• Not every configuration is eligible. For example, the 2.6.3.0 auto-upgrade skips servers whose miiserver.exe.config or miisclient.exe.config was modified.
• Upgrading doesn't move an existing server to application-based authentication. Earlier builds could switch servers in the background; from 2.6.84.0, only the wizard task does it.
• When an auto-upgrade attempt fails, the reason is in the Application event log.

Step-by-step: in-place upgrade#

1. Pick a quiet window and close Synchronization Service Manager and any open Connect wizard.
2. Run the new MSI on the server, choose Upgrade and sign in when prompted.
3. Microsoft advises checking that filtering wasn't changed before the first sync after an upgrade. To do that, clear Start the synchronization process when configuration completes on the final page, then compare domain/OU selections and custom rules with your export.
4. Unless the server already uses application-based authentication, rerun Microsoft Entra Connect and choose Configure application-based authentication to Microsoft Entra ID. From 2.6.84.0, setup stops with an error instead of silently falling back to the legacy account, so fix the underlying cause.
5. Re-enable the scheduler if you paused it: Set-ADSyncScheduler -SyncCycleEnabled $true.

When a swing upgrade is the better choice#

In a swing upgrade you build a new server with the latest build, import the JSON configuration in staging mode and let it import and synchronize. Then you review its pending exports with csexport and switch roles: the old server goes into staging mode and the new one comes out. Choose this when a full sync of a large database would take hours, when the old server runs an OS you want to leave (Windows Server 2016 is nearing the end of extended support), or when you want instant rollback. Upgrade staging servers too and configure application-based authentication on them, because they still sign in to Microsoft Entra ID to import.

Verify after the upgrade#

• The version check returns the new build, and Connect Health raises no new alerts for the server (see Connect Health agents and alerts).
• Get-ADSyncScheduler shows SyncCycleEnabled : True and the same staging state as before.
• The first import, sync and export runs succeed, with no unexpected deletes. If you changed filtering at the same time, follow my filtering guide.
• A test password change syncs. 2.6.84.0 removed password hash sync self-healing, so if its cloud feature flag is off, an administrator must turn it back on explicitly.
• If you use app-scoped Conditional Access, review policies that target Microsoft.Azure.SyncFabric or Microsoft 365 Reporting Service, because 2.6.91.0 added Microsoft Graph permissions.

Tips and gotchas#

• Install the latest build. Version 2.6.79.0 was recalled, and 2.6.84.0 can fail with 0xE0474352 when installed over an existing ADSync database (fixed in 2.6.91.0).
• Sync fails after upgrade with a FileLoadException for System.Diagnostics.DiagnosticSource. This is a known issue (documented for 2.5.190.0 and 2.6.1.0) on servers whose miiserver.exe.config was customised, for example for password hash sync on FIPS-enabled servers. Microsoft's workaround adds a binding redirect to that file and restarts ADSync.
• Avoid Synchronization Service Manager on 2.5.x. Microsoft warns that using it on 2.5.x builds can break the wizard and certificate renewal; 2.6.1.0 fixed this.
• Keep the scheduler running. Connect manages its own authentication certificate (since 2.6.1.0: 90-day default lifetime, renewed after 70% of it has elapsed), and the rotation logic follows the scheduler's state, so don't leave the scheduler off for weeks.
• Thinking about leaving Connect Sync? 2.6.91.0 adds a guided migration workflow to Cloud Sync; see Cloud Sync vs Connect Sync.

References#

• Microsoft Entra Connect: Version release history
• Security improvements to Microsoft Entra Connect Sync autoupgrade and Connect Health alerts