Lesson 27 — Microsoft Entra Connect Health
Microsoft Entra Connect Health gives administrators visibility into the health and performance of hybrid identity infrastructure that connects on-premises Active Directory to Microsoft Entra ID.
A cloud sign-in problem may begin on an on-premises synchronisation server, with an unhealthy agent, a stopped service, an export error or password hashes that never reached Microsoft Entra ID.
This lesson explains Connect Health architecture, Sync Services, health agents, synchronisation errors, Password Hash Synchronisation, staging servers, alert notifications, data freshness and operational recovery.
What you will learn
This lesson explains how to monitor Microsoft Entra Connect Sync, health agents, password synchronization and hybrid identity recovery.
Learning objectives
After completing this lesson, you should be able to monitor and investigate Microsoft Entra Connect Health.
- Explain the role of Microsoft Entra Connect Health.
- Identify the main Connect Health components and agents.
- Review Sync Services, alerts and synchronisation errors.
- Monitor Password Hash Synchronisation health.
- Recognise stale health data and agent communication failures.
- Understand active and staging server responsibilities.
- Build an operational hybrid identity health checklist.
The problem this solves
Hybrid identity depends on infrastructure that sits outside Microsoft Entra ID.
If the synchronisation server, database, connector, health agent or password synchronisation process fails, cloud identities can become outdated even while Microsoft Entra ID remains available.
Hybrid identity health model
What is Microsoft Entra Connect Health?
Microsoft Entra Connect Health is a monitoring service for supported hybrid identity infrastructure.
It provides alerts, service status, performance information and synchronisation error reporting so administrators can identify problems before they create widespread user impact.
What it does not replace
Connect Health does not replace server monitoring, backups, change control or direct inspection of the synchronisation engine.
Use it as part of a broader operational monitoring design.
Connect Health components
| Component | Purpose | Health question |
|---|---|---|
| Connect Health service | Cloud service that receives and presents health information. | Is the hybrid identity environment reporting normally? |
| Sync Health Agent | Collects information from Microsoft Entra Connect Sync. | Is the synchronisation server communicating with Connect Health? |
| Monitoring services | Collect operational and performance information. | Are required local services running? |
| Insights services | Collect configuration and diagnostic information. | Is health data complete and current? |
| Sync error reporting | Surfaces object-level synchronisation failures. | Which identities failed to synchronise and why? |
| Notification settings | Controls alert email recipients. | Will the correct responders receive health alerts? |
Sync Services
The Sync Services view provides a tenant-level picture of registered Microsoft Entra Connect Sync deployments.
Review alerts, service status and synchronisation errors for the monitored environment.
Start with the service card
Confirm that the expected synchronisation server appears, its data is current and no unexpected or retired server remains registered.
Unexpected servers can indicate an incomplete migration or stale health registration.
Connect Health alert lifecycle
Active alerts
Active alerts identify conditions that still require investigation.
Review the affected server, first detected time, last detected time, description and remediation guidance.
Resolved alerts
Resolved alerts remain useful for trend analysis.
Repeated auto-resolving alerts can reveal intermittent network, service or capacity problems.
Common Connect Health alert areas
| Alert area | Possible cause | Operational impact |
|---|---|---|
| Health data not current | Agent, service, connectivity or data-collection failure. | Portal health information becomes stale. |
| Sync service unavailable | Microsoft Entra Sync service stopped or server unavailable. | Directory changes stop synchronising. |
| Password Hash Sync heartbeat missed | Password synchronisation cannot communicate or is unhealthy. | New password changes may not reach Microsoft Entra ID. |
| Export errors | Duplicate values, permissions, attributes or connector errors. | Objects remain outdated in Microsoft Entra ID. |
| Import errors | Source directory connectivity or data problems. | On-premises changes are not detected. |
| Agent failure | Local health services stopped or damaged. | Health reporting becomes incomplete. |
Alert notification settings
Configure notifications so the correct operational team receives Connect Health alerts.
Use a monitored team mailbox or distribution list rather than relying on one employee.
Notification review
- Confirm intended recipients.
- Remove departed administrators.
- Test delivery after organisational changes.
- Document escalation ownership.
- Review notification settings regularly.
Health service data freshness
Connect Health agents periodically upload data from monitored on-premises machines.
If complete data is not received for the expected period, Connect Health raises a data freshness alert. A stale portal does not prove synchronisation has stopped—but it means the monitoring view must be verified directly.
Data freshness investigation
- Confirm server clock and time synchronisation.
- Check Connect Health monitoring services.
- Check Connect Health insights services.
- Review proxy, firewall and outbound connectivity.
- Review local event logs for agent errors.
- Confirm required performance counters exist.
Monitoring is not syncing
The Sync engine may still be operating while the Health Agent cannot upload health information.
Always compare Connect Health with direct checks on the synchronisation server.
Microsoft Entra Connect Sync engine
| Stage | Purpose | Failure example |
|---|---|---|
| Import | Reads changes from Active Directory or Microsoft Entra ID. | Connector cannot contact the source directory. |
| Synchronization | Applies joins, projections, attribute flows and rules. | Conflicting or invalid object data. |
| Export | Writes pending changes to the target directory. | Duplicate proxy address blocks an export. |
| Password sync | Synchronises password hashes independently of the normal object cycle. | Password changes remain on-premises only. |
Synchronization Service Manager
Synchronization Service Manager provides direct visibility into connectors, run history, operations and errors.
Use it for investigation, but avoid unsupported configuration changes outside the Microsoft Entra Connect wizard.
Run history
Review recent import, synchronisation and export profiles.
Look for connectivity failures, completed-with-errors, unusually long runs and repeated retries.
Object-level synchronisation errors
| Error pattern | Meaning | Investigation |
|---|---|---|
| Duplicate attribute | A unique value already exists on another object. | Search for duplicate UPN, proxy address or source anchor values. |
| Data validation failure | An attribute does not meet target requirements. | Review the failing attribute and source data. |
| Large attribute | A value exceeds a supported limit. | Review group membership or oversized attributes. |
| Permission failure | The connector account cannot perform the required operation. | Validate permissions and recent account changes. |
| Object conflict | Cloud and on-premises identity matching is inconsistent. | Review source anchor, matching and object ownership. |
Prioritise by impact
A single low-impact contact error is different from hundreds of failed user exports.
Prioritise privileged accounts, authentication attributes, mail-enabled identities and widespread error patterns.
Never delete first
Do not delete or hard-match objects as a first troubleshooting step.
Preserve evidence and understand the source of authority before remediation.
Password Hash Synchronisation
Password Hash Synchronisation allows Microsoft Entra Connect to synchronise a derived hash of an on-premises Active Directory password hash to Microsoft Entra ID.
Password sync is separate
Password Hash Synchronisation is not simply the normal thirty-minute object synchronisation cycle.
Password changes use a separate mechanism and normally reach Microsoft Entra ID much sooner.
Heartbeat monitoring
Connect Health monitors Password Hash Synchronisation heartbeats.
A missed heartbeat indicates that password changes may not be synchronising.
Password Hash Sync investigation workflow
One user or everyone?
A single-user problem often points to object state, scope or account-specific issues.
A widespread problem suggests service, connector, credential, network or configuration failure.
Use supported troubleshooting
Microsoft Entra Connect includes a troubleshooting task for Password Hash Synchronisation.
Use supported diagnostics before manually changing services, connectors or database state.
Active server and staging server
| Capability | Active server | Staging server |
|---|---|---|
| Imports directory data | Yes | Yes |
| Runs synchronisation rules | Yes | Yes |
| Maintains pending exports | Yes | Yes |
| Exports changes | Yes | No |
| Password Hash Synchronisation | Active | Not active for production export |
| Password writeback | Active where configured | Not active while staging |
| Primary purpose | Production synchronisation | Warm standby and recovery |
Why staging mode matters
A staging server maintains an up-to-date synchronisation database without exporting changes.
It provides a supported recovery path if the active server fails.
Staging is not automatic failover
Administrators must deliberately promote the staging server and ensure only one server is actively exporting.
Document and test the promotion process before an outage.
Safe failover sequence
Configuration consistency
The active and staging servers should use equivalent scope, rules and connector configuration.
Use supported configuration migration processes and validate differences before promotion.
Version health
Keep Microsoft Entra Connect Sync on a supported and current release.
Review release notes, prerequisites and rollback planning before upgrades.
Operational dependencies
| Dependency | Why it matters | Monitor |
|---|---|---|
| Windows Server | Hosts the synchronisation engine and agents. | Availability, patching, CPU, memory and disk. |
| SQL database | Stores synchronisation configuration and state. | Database health, storage and service availability. |
| Active Directory | Source for hybrid users, groups and attributes. | Domain controller connectivity, DNS and replication. |
| Outbound HTTPS | Required for cloud communication and health uploads. | Firewall, proxy, TLS inspection and name resolution. |
| Service accounts | Run services and access directories. | Credential state, permissions and policy changes. |
| Time synchronisation | Supports authentication, logging and reliable health data. | Clock drift and NTP health. |
Server monitoring
- Microsoft Entra Sync service state.
- Connect Health service state.
- CPU and memory pressure.
- Disk space and database growth.
- Event log errors.
- Pending operating system restart.
- Backup and recovery status.
Change monitoring
- Connect configuration changes.
- Connector account changes.
- Synchronization rule changes.
- Service account policy changes.
- Proxy and firewall changes.
- Server upgrades and migrations.
Agent Foskett investigation: “Everyone changed their password…”
Evidence to preserve
- Connect Health alert details.
- Synchronization run history.
- Relevant Windows event logs.
- Service state and start account.
- Recent change records.
- Affected user scope and timestamps.
- Connector and server configuration.
Validate remediation
- Confirm the health alert resolves.
- Confirm current health data arrives.
- Confirm import, sync and export complete.
- Confirm Password Hash Sync heartbeat returns.
- Test a controlled password change.
- Confirm no new object errors appear.
Daily hybrid identity review
| Review | Question | Evidence |
|---|---|---|
| Connect Health alerts | Are there active or repeating alerts? | Active and resolved alert history. |
| Data freshness | Is health information current? | Latest agent and service data. |
| Sync cycle | Are imports, syncs and exports completing? | Synchronization Service Manager run history. |
| Sync errors | Are objects failing? | Connect Health sync errors and connector space. |
| Password sync | Are password hashes synchronising? | Heartbeat, diagnostics and controlled tests. |
| Server health | Is the active server operating normally? | Services, event logs, CPU, memory and disk. |
| Recovery | Is the staging server ready? | Configuration comparison and recent test. |
Weekly review
- Review recurring resolved alerts.
- Review object error trends.
- Confirm notification recipients.
- Review server resource trends.
- Check staging server health.
- Review pending updates.
Monthly review
- Test the failover procedure.
- Validate a controlled password change.
- Review Connect version support.
- Review service and connector accounts.
- Review backup and recovery documentation.
- Confirm ownership and escalation paths.
Common mistakes
| Mistake | Impact | Better practice |
|---|---|---|
| Assuming portal health proves sync health | Stale agent data may hide current server state. | Compare portal signals with direct server checks. |
| Ignoring auto-resolved alerts | Intermittent failures continue until an outage. | Review recurring resolved alerts and trends. |
| No staging server | Recovery becomes a rebuild during an outage. | Maintain and test a supported staging deployment. |
| Two active export servers | Unsupported synchronisation behaviour. | Ensure only one server exports changes. |
| Treating password sync as normal sync | Password-specific failures are misunderstood. | Monitor Password Hash Sync separately. |
| Editing connectors directly | Configuration can become unsupported. | Use the wizard and supported tools. |
| Alerting one administrator | Alerts are missed during leave or staff changes. | Use a monitored operational group. |
Security best practices
- Restrict administrative access to Connect servers.
- Treat Connect servers as high-value identity infrastructure.
- Use dedicated service accounts and least privilege.
- Protect backups and configuration exports.
- Monitor interactive logons to Connect servers.
- Review unexpected service and rule changes.
- Keep the operating system and Connect release supported.
Operational checklist
- Expected server registered.
- Health data current.
- No active critical alerts.
- Sync cycles completing.
- Object errors assigned.
- Password Hash Sync healthy.
- Notification recipients current.
- Staging server ready.
- Recovery process documented.
Key takeaways
- Microsoft Entra Connect Health monitors supported hybrid identity infrastructure.
- Connect Health signals must be compared with direct synchronisation server evidence.
- Health data freshness problems can make the portal unreliable even when synchronisation continues.
- Import, synchronisation, export and Password Hash Synchronisation are distinct operational areas.
- Object-level errors should be prioritised by identity and business impact.
- Password Hash Synchronisation uses a dedicated process and health heartbeat.
- A staging server provides a supported warm-standby recovery path but does not fail over automatically.
- Only one Microsoft Entra Connect server should actively export changes.
- Repeated resolved alerts should be investigated, not ignored.
- Hybrid identity monitoring must include servers, agents, connectors, services, networks and recovery procedures.
Related Agent Foskett resources
Continue learning
Microsoft Entra Connect Health
Microsoft Entra Connect Health provides monitoring, alerts, service status and synchronisation error reporting for supported hybrid identity infrastructure.
Microsoft Entra Academy Lesson 27 — Connect Health
This Agent Foskett lesson explains Sync Services, Connect Health agents, alert notifications, stale health data, synchronization operations, Password Hash Synchronisation, staging servers and hybrid identity recovery.
