What this check looks at
For hybrid tenants, checks that directory synchronisation has run recently.
In a hybrid organisation, Microsoft Entra Connect Sync or Entra Cloud Sync copies users, groups and password hashes from on-premises Active Directory to Microsoft Entra ID, every 30 minutes by default. Account changes made on premises, including disabling a leaver, resetting a password or removing someone from a group, reach Microsoft 365 only through that sync.
This check applies to tenants with directory synchronisation enabled and reads when Microsoft Entra ID last received a sync. It passes within three hours and warns between three and 24 hours. The check fails, at high severity, when sync has not run for more than 24 hours. It also warns when sync is enabled but Microsoft did not return a last sync time.
When sync stops, the two directories drift apart without anyone noticing: a leaver disabled in Active Directory keeps working in Microsoft 365, new starters have no mailbox, and password resets on premises do not apply in the cloud. Common causes are a stopped ADSync service, a full disk, an expired or locked connector account, a server left in staging mode, an Entra Connect version Microsoft has retired, or the only sync server being decommissioned.
Why it matters
When sync stalls, leavers disabled on premises stay enabled in the cloud. The gap between the two directories is exactly the window an ex-employee still has access.
At an 80-person firm, the Entra Connect server’s disk filled up and sync stopped. Three weeks later a sales manager left for a competitor; IT disabled the account in Active Directory as usual, but in Microsoft 365 it stayed enabled. He kept downloading the client list from SharePoint for another fortnight, and the firm only found out during the investigation.
Sync health is quick to check and easy to alert on. Microsoft Entra Connect Health can email alerts when sync stops, and Microsoft sends synchronisation error reports to the tenant’s technical contact, but only if someone reads that mailbox.
CIS Controls v8 safeguard 6.7 (centralise access control), ISO 27001 A.5.16 (identity management), the NCSC 10 Steps identity and access management guidance and the NCSC CAF identity and access management outcome rely on one source of identity being applied everywhere. NIST CSF PR.AA-01 covers identities and credentials being managed.
How to fix it
Where: Entra admin centre → Identity → Hybrid management → Microsoft Entra Connect
Before you start
- Check the Entra Connect server is running and can reach the internet, and look at its event log.
Step by step
- Check the last sync in the portal. In the Microsoft Entra admin centre, go to Entra ID > Entra Connect > Connect Sync and note the last sync time and any warnings. If the tenant uses Cloud Sync, open Entra ID > Entra Connect > Cloud sync and check the agent status and the configuration’s last run.
- Check the sync server. On the Entra Connect server, check the Microsoft Azure AD Sync (ADSync) service is running, there is free disk space, and the server can reach the internet. Open Synchronization Service Manager and look at the Operations tab for the last runs and any errors.
- Check the scheduler and start a sync. In PowerShell on the server, run Get-ADSyncScheduler. SyncCycleEnabled must be True and StagingModeEnabled False on the active server. If the scheduler is off, run Set-ADSyncScheduler -SyncCycleEnabled $true, then start a sync with Start-ADSyncSyncCycle -PolicyType Delta and watch it in Synchronization Service Manager.
- Fix credentials and update the version. If runs fail with access errors, the Active Directory connector account’s password may have expired or changed: reset it and update it in the Entra Connect wizard (Customise synchronisation options > Connect your directories). Compare the installed version with Microsoft’s Entra Connect version history and upgrade if it is retired or close to retirement.
- Check a change reaches the cloud. After a successful run, Entra ID > Entra Connect > Connect Sync should show a last sync within the hour. Make a harmless change on premises (for example a test user’s job title) and check it appears in Entra ID after the next cycle.
- Set up alerting. Install or check Microsoft Entra Connect Health for sync (it needs Entra ID P1) and set its alert notifications to a monitored address. Check the technical contact under Entra ID > Overview > Properties is a monitored mailbox, as Microsoft sends synchronisation error reports there.
- Retire sync properly if it is no longer needed. If on-premises Active Directory is being retired, plan to turn off directory synchronisation so the accounts become cloud-only, rather than leaving a stalled sync in place.
- Confirm sync is running. Reopen Entra ID > Entra Connect > Connect Sync: the last sync should be under three hours ago. The finding clears at the next assessment.
What users will notice
None once fixed. While sync is broken, new starters and password changes do not reach Microsoft 365.
How to confirm it worked
Entra ID, Entra Connect, Connect Sync shows the last sync within the last hour.
Frameworks and controls
This check maps to controls in 11 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM) |
| DSPT | Standard 4: Managing data access |
| Microsoft Cloud Security Benchmark | IM-1 Use centralised identity and authentication system |
| Zero Trust | Identities |
| SOC 2 | CC6.2 User registration, authorisation and removal |
| NIST SP 800-171 | 3.5.1 Identify system users, processes and devices |
| CMMC Level 2 | IA.L2-3.5.1 Identification |
| ISO 27001:2022 | A.5.16 Identity management |
| CIS Controls v8.1 | 6.7 Centralize access control (IG2) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Entra Connect Health (Microsoft Learn)