Entra Connect Sync: the 12-month rule that can quietly break your identity sync

Many organisations still run their own on-premises Active Directory alongside Microsoft 365. Somewhere in that setup sits a server running Entra Connect Sync, formerly known as Azure AD Connect, syncing users, passwords and groups to the cloud. That server usually runs quietly in the background for years, until the version it is running suddenly loses support.

That is what happened to version 2.5.79.0 on 23 October this year, barely two weeks ago. That version was the newest release as recently as 1 September 2025. In just over thirteen months it went from current recommendation to unsupported, without a single standalone announcement most administrators would have noticed.

How the twelve-month rule works

Since 15 March 2023, Microsoft has applied a fixed rule to Entra Connect Sync: every 2.x version loses support twelve months after a successor ships. There is no annual patch cycle like Windows Server has, just a continuously rolling schedule. The moment a new version lands, the clock starts on the previous one, regardless of when your organisation actually installed it.

The pace of releases therefore sets the pace of mandatory upgrades. In 2026 alone, Microsoft shipped four major versions: 2.6.1.0 in February, 2.6.3.0 in March, 2.6.84.0 in July and 2.6.91.0 in September. Tracking this properly means checking which version is still valid roughly every quarter, not once a year.

What end of support actually means

A retired version does not stop syncing immediately. What disappears are the security fixes, bug fixes and support if something breaks. Microsoft itself warns that an outdated version can stop working unexpectedly. For an organisation running user provisioning, group membership and password hash sync through this one component, that is not a theoretical risk but a direct business continuity question.

The hard deadline of 7 April 2027

On top of the rolling twelve-month rule, Microsoft has now also drawn a fixed line. Before 7 April 2027, every Entra Connect Sync server must run at least version 2.6.84.0 and must have switched to application-based authentication. The older method, where the sync server signs in to Entra ID using a separate service account, is being phased out. Miss that date and synchronisation stops, regardless of which version happens to be running at the time.

That switch is more than a checkbox. In version 2.6.84.0, Microsoft also removed the automatic fallback to the old service account. If setting up application-based authentication fails, the installation wizard now stops with an error instead of quietly falling back to the weaker method. That is a deliberate choice: half-migrated environments get surfaced instead of being allowed to keep running unnoticed.

Password hash sync now needs a manual check

One detail that is easy to miss: since version 2.6.84.0, Entra Connect Sync no longer automatically restores password hash synchronisation if that cloud setting gets switched off. It used to re-enable itself the moment the sync server detected a mismatch. Now an administrator has to do that manually. Does your organisation rely on password hash sync as a fallback for when Pass-through Authentication goes down? Check after every upgrade that the setting is still active.

Moving to Cloud Sync is getting easier

Microsoft is also nudging organisations towards the alternative: Entra Cloud Sync, where a lightweight provisioning agent runs on a server instead of the full Connect Sync installation, and management happens mostly in the cloud. Since version 2.6.91.0, released mid-September, the wizard itself includes a guided migration flow: an assessment of the current configuration, setting up the provisioning agent, a staged activation and a validation step, all from the same interface.

Cloud Sync is not a drop-in replacement for every environment yet. Complex attribute-based filtering and some device object scenarios do not fully match Connect Sync's behaviour at the time of writing. For an organisation with a simple hybrid setup, one domain, standard groups, the move is usually already realistic, and it cuts maintenance considerably: no more Windows server to patch and monitor yourself.

What you can arrange this month

Four steps that do not require a big project. First, check which version of Entra Connect Sync your server is running, visible in the synchronisation service manager or the Entra admin center, and compare it against Microsoft's current version table. Second, check whether the server has already switched to application-based authentication or still uses the old service account. Third, if password hash sync is an important fallback for your organisation, check manually after every upgrade that it is still active. Fourth, let the assessment in the wizard tell you whether Cloud Sync is already a realistic replacement, or stay on Connect Sync for now and simply keep up with the upgrades.

For many IT teams, identity sync sits near the bottom of the priority list, until users cannot sign in one morning. The twelve-month rule and the April 2027 deadline are not a reason to panic, but they are a reason to schedule a regular check now instead of finding out by accident. Want help mapping your hybrid identity environment or planning the move to Cloud Sync? Get in touch with Zarioh for a no-obligation conversation.