Entra Connect Sync Deadline: Synchronization Stops September 30, 2026

If you run hybrid identity, the Entra Connect Sync deadline is now inside your change-freeze horizon. Microsoft has published a Mandatory Upgrade Required notice stating that all synchronization services in Microsoft Entra Connect Sync will stop working on September 30, 2026 if the server is not running at least version 2.5.79.0 (Microsoft Learn). This is service-side enforcement rather than a conventional end-of-support notice. There is no degraded mode and no grace period. A quieter event landed on 01 September 2026, when version 2.5.76.0 reached end of support. The design question is no longer whether to patch, but whether to spend the change window on a tactical version bump, a swing migration to a build with runway, or a move to Microsoft Entra Cloud Sync.

What Changed in the Entra Connect Sync Service Contract

Microsoft deployed a dedicated first-party application to broker synchronization between Active Directory and Entra ID. It surfaces in Enterprise Applications as the service principal Microsoft Entra AD Synchronization Service, Application ID 6bf85cfa-ac8a-4be5-b5de-425a0d0dc016. Version 2.5.79.0 carries the client-side changes needed to authenticate against that hardened back end (Microsoft Learn).

The documented impact is unambiguous: all synchronization services fail and remain failed until the upgrade completes. Restarting the ADSync service, forcing a delta cycle, or rebooting will not clear a back-end version rejection. Two prerequisites gate the upgrade: .NET Framework 4.7.2 or later and TLS 1.2. The .msi is now distributed exclusively through the Microsoft Entra admin center.

Why It Matters: The Failure Mode Is Silent Directory Drift

A sync outage does not present as a tenant-wide sign-in failure. Cloud objects persist, tokens continue to issue, and nobody notices on day one. What stops is the flow of on-premises state into Entra ID:

• Password hash synchronization, so on-premises password changes never reach the tenant
• New user, group, and contact provisioning, stalling every onboarding runbook
• Account disable and delete propagation, the control offboarding depends on
• Attribute flow, group membership updates, and any enabled writeback operations
• Changes driven by custom sync rules and OU or attribute-based filtering

The deprovisioning gap deserves the security team’s attention. A technician disables a leaver in Active Directory, the checklist is ticked, and cloud access stays live. Because the server holds credentials that can write to the directory, Microsoft treats it as a Control Plane, formerly Tier 0, asset. Plan the upgrade accordingly: approvals, rollback, and post-change verification.

The Version Trap: 2.5.79.0 Is a Compatibility Floor, Not a Target

Entra Connect Sync 2.x versions retire 12 months from the date a newer version is released, a policy in effect since 15 March 2023. The clock runs from the next build shipping, not your install date, so an untouched server can move from supported to retired with no change on your side. Read the retirement table next to the cutoff and the trap is visible: the minimum compliant build reaches end of support three weeks later (Microsoft Learn).

Version	Published End of Support	Position vs. the Cutoff
2.4.131.0 and earlier	26 May 2026 or earlier	Below the floor. Sync fails.
2.5.3.0	31 July 2026	Below the floor. Sync fails.
2.5.76.0	01 September 2026	Below the floor. Sync fails.
2.5.79.0	23 Oct 2026	Minimum compliant build. Clears the cutoff by three weeks.
2.5.190.0	02 Feb 2027	Compliant, with runway.
2.6.1.0	10 Mar 2027	Compliant, with runway.
2.6.3.0	07 Jul 2027	Compliant, with runway.
2.6.84.0	None published	Latest release. Includes security fixes.

All 1.x versions are non-functional. Entra cloud services stopped accepting Azure AD Connect V1 connections on October 1, 2023 (Microsoft Learn).

Recommended Actions Before September 30

1. Inventory every installation, not just the active node. Include staging-mode servers, standby hosts, leftovers from previous swing migrations, powered-off virtual machines, and test servers pointed at production.
2. Record the exact build from Programs and Features on each server. Run Get-ADSyncAutoUpgrade, but do not treat Enabled as evidence the update landed.
3. Validate prerequisites first: .NET Framework 4.7.2 or later, and TLS 1.2 in both the .NET client configuration and Windows Schannel. Get-ADSyncToolsTls12 confirms this.
4. Select a target build with runway rather than the minimum, export the current configuration, then obtain the .msi from the Entra admin center.
5. Choose the upgrade method deliberately. In-place suits a single server under roughly 100,000 objects. Microsoft recommends a swing migration for major configuration changes, operating system upgrades, or servers not upgraded in 12 to 18 months (Microsoft Learn).
6. Review the known issue affecting 2.5.190.0 and 2.6.1.0, where sync fails after upgrade if miiserver.exe.config was modified. The workaround is a binding redirect for System.Diagnostics.DiagnosticSource.
7. Verify outcomes, not installer exit codes. Prove a test password change reaches the tenant, a test account provisions, and a test disable propagates. Record the next end-of-support date before closing the change.

Should You Move to Microsoft Entra Cloud Sync Instead?

Cloud Sync is Microsoft’s strategic direction, and new synchronization features are developed primarily on that platform. It removes the single point of failure through multiple active agents and supports disconnected forests. Migration eligibility is rolling out in phases (Microsoft Learn).

The gating factors are specific. Cloud Sync currently supports up to 150,000 objects per domain and groups up to 50,000 members, against unlimited scale and 250,000-member groups in Connect Sync. Device synchronization for Hybrid Azure AD Join, advanced sync rules, cross-forest references, attribute merging, device writeback, and reconciliation are not supported. Running both tools against the same objects is unsupported, so use OU-based scoping during a phased cutover (Microsoft Learn). Either way, the deadline applies to any server still running Connect Sync. Clear the version floor first, then plan the platform move separately.

Frequently Asked Questions About the Entra Connect Sync Deadline

Is Microsoft Entra Connect being decommissioned entirely?

No. What is enforced is a minimum version of 2.5.79.0. Separately, Microsoft has begun a phased transition toward Cloud Sync. Azure AD Connect V1 is fully retired.

What exactly happens if we miss September 30, 2026?

All synchronization services fail and stay failed until the server is upgraded. Microsoft documents no grace period.

Is 2.5.79.0 the right version to install?

It is the compatibility floor, not a destination. Its end of support is 23 Oct 2026. Choose a later build so your next upgrade is a year out.

Our servers have auto-upgrade enabled. Are we covered?

Verify rather than assume. Not all configurations are eligible and not all releases ship through auto-upgrade. Confirm the build on every server.

Should we upgrade in place or perform a swing migration?

In-place suits a single server with a modest object count and no significant configuration change. Microsoft recommends a swing migration for major configuration changes, operating system upgrades, or long-neglected servers, since it preserves rollback.

Does migrating to Cloud Sync exempt us from the deadline?

Only if migration completes and Connect Sync stops synchronizing first. Any server still running Connect Sync below 2.5.79.0 will fail.

Ready to Clear the Entra Connect Sync Deadline Without an Identity Outage?

The Partner Masters helps organizations and Microsoft partners clear the Entra Connect Sync deadline: inventory, prerequisite validation, upgrade planning as a Control Plane change, and verification that synchronization resumed. Schedule a consultation to:

• Inventory every Entra Connect Sync server, including staging and standby nodes
• Confirm your version position against the published retirement table
• Validate .NET Framework and TLS 1.2 readiness before the change window
• Select a target build with runway and design the in-place or swing approach
• Assess Cloud Sync eligibility against scale, group size, and sync rules
• Plan a controlled pilot, cutover, and post-change verification

APPENDIX

Additional Manufacturer and Independent Research Resources

Official Manufacturer Resources

• Microsoft Entra Connect: Prerequisites and hardware
• Hardening update to Microsoft Entra Connect Sync
• Microsoft Entra Connect: Version release history and retirement table
• Microsoft Entra Connect: Upgrade from a previous version to the latest
• Security improvements to Microsoft Entra Connect Sync autoupgrade and Connect Health alerts
• Decommission Azure AD Connect V1
• Migrate from Microsoft Entra Connect to Cloud Sync: Decision Guide
• Migrate from Microsoft Entra Connect Sync to Cloud Sync FAQ
• Azure Active Directory (AD) Connect product lifecycle
• Microsoft Entra admin center (Entra Connect download location)

Independent Research and Standards Guidance

• NIST SP 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management
• CISA: Microsoft Entra ID and hybrid identity secure configuration guidance (SCuBA)
• ENISA: Cloud Security Guidance and Risk Assessment publications