Entra Connect Sync Error Troubleshooting: How to Diagnose and Fix the Synchronization Failures That Break Hybrid Identity

Open the Synchronization Service Manager on the Entra Connect server (Start > Synchronization Service):

1. Click the Connectors tab
2. Select the 'contoso.onmicrosoft.com - AAD' connector (the Entra ID connector)
3. Click 'Search Connector Space'
4. Set 'Scope' to 'Export Error' and click 'Search'

This shows all objects that failed to export to Entra ID in the last sync cycle. Double-click any object to see the specific error and the attribute values that caused it.

Alternatively, use PowerShell:

# List all objects currently in export error state
Get-ADSyncCSObject -ConnectorName "contoso.onmicrosoft.com - AAD" `
    | Where-Object {$_.ErrorName -ne ""} `
    | Select-Object DistinguishedName, ErrorName, ErrorDetail `
    | Format-Table -AutoSize

# Trigger a delta sync to refresh the error state after a fix
Start-ADSyncSyncCycle -PolicyType Delta

For organizations with Entra Connect Health deployed, sync errors are also visible at: Entra ID admin center > Identity > Hybrid management > Connect Health > Sync errors. This view is accessible to Entra ID admins without needing RDP access to the sync server.

Duplicate attribute conflicts are the most common sync error. Two on-premises objects have the same value for a unique attribute (UserPrincipalName, ProxyAddresses, or MailNickName). Entra ID rejects the second object.

Identify the conflicting objects:

# Find all objects with AttributeValueMustBeUnique errors
Get-ADSyncCSObject -ConnectorName "contoso.onmicrosoft.com - AAD" `
    | Where-Object {$_.ErrorName -eq "AttributeValueMustBeUnique"} `
    | ForEach-Object {
        [PSCustomObject]@{
            DN = $_.DistinguishedName
            Error = $_.ErrorName
            Detail = $_.ErrorDetail
        }
    }

For ProxyAddresses conflicts specifically:

# Find all AD users sharing a specific email address
$conflictingEmail = "user@domain.com"
Get-ADObject -Filter {ProxyAddresses -like "*$conflictingEmail*"} -Properties ProxyAddresses |
    Select-Object DistinguishedName, ObjectClass, ProxyAddresses

Resolution options:

1. Remove the duplicate from one object: Remove the conflicting ProxyAddresses value from the object that should NOT be the primary holder
2. Soft match the cloud object: If a cloud-only account already exists with the same UPN, use the ImmutableId to hard-match it to the on-premises object
3. Enable Duplicate Attribute Resiliency (should already be on by default in recent Entra Connect versions):

Get-MsolDirSyncFeatures | Where-Object {$_.Feature -eq "EnableSoftMatchOnUpn"}
Set-MsolDirSyncFeature -Feature DuplicateUPNResiliency -Enable $true
Set-MsolDirSyncFeature -Feature DuplicateProxyAddressResiliency -Enable $true

With resiliency enabled, the duplicate object syncs with the conflicting attribute quarantined (replaced with a placeholder value) rather than blocking the entire object from syncing.

If a user exists in AD but not in Entra ID, the object may be excluded by a sync filter:

Check 1: Is the OU included in Entra Connect's OU filter? Entra Connect admin UI: Configure > Customize synchronization options > Filter users and devices > select domain and check OU list. If the user's OU is unchecked, they are excluded.

Check 2: Is an attribute-based filter excluding the object? Check the Synchronization Rules Editor for inbound rules with scoping filters:

# List all active inbound sync rules with scoping filters
Get-ADSyncRule | Where-Object {$_.Direction -eq "Inbound" -and $_.ScopeFilter -ne ""} |
    Select-Object Name, ScopeFilter | Format-List

Check 3: Is the user in the connector space at all?

# Search for the specific user in the AD connector space
Get-ADSyncCSObject -ConnectorName "domain.com - ADMA" -DistinguishedName "CN=John Smith,OU=Users,DC=domain,DC=com"

If the user is not found in the connector space, they are filtered out before sync rules run. If they are in the connector space but not in the metaverse, a sync rule is excluding them.

Check 4: Force a preview of what would sync for the object From Synchronization Service Manager: Metaverse Search > find the object > Connectors tab > preview the sync rules applied to see why the object is not exporting to Entra ID.

Password hash synchronization (PHS) failures prevent cloud authentication from working with on-premises passwords:

# Check PHS sync status
Get-ADSyncAADPasswordSyncConfiguration -SourceConnector "domain.com - ADMA" |
    Select-Object Enabled, PasswordSyncState

# Force a full password hash sync for a specific user
Invoke-ADSyncRunStep -ConnectorName "domain.com - ADMA" -RunProfile "Full Synchronization"

# Check password sync events in the Application event log
Get-WinEvent -LogName Application -ProviderName 'Directory Synchronization' `
    | Where-Object {$_.Message -match 'password'} `
    | Select-Object TimeCreated, Message `
    | Select-Object -First 20

For password writeback failures (SSPR writing back to on-premises AD):

# Check password writeback configuration
Get-ADSyncAADPasswordResetConfiguration -Connector "contoso.onmicrosoft.com - AAD" |
    Select-Object Enabled

# Common writeback failure: Entra Connect service account lacks 'Reset Password' permission
# on the user OU -- verify with:
$syncAccount = (Get-ADSyncConnector -Name "domain.com - ADMA").ConnectivityParameters |
    Where-Object {$_.Name -eq "forest-login-user"} | Select-Object -ExpandProperty Value
Write-Output "Sync account: $syncAccount"
# Then verify this account has Reset Password delegated on the target OUs

If the sync service is not running or a sync cycle is stuck:

# Check sync service status
Get-Service ADSync

# Check if a sync cycle is currently running
Get-ADSyncScheduler | Select-Object SyncCycleInProgress, NextSyncCyclePolicyType, NextSyncCycleStartTimeInUTC

# If stuck in SyncCycleInProgress = True for more than 2 hours, restart the service
Restart-Service ADSync

# After restart, check connector run history for errors
Get-ADSyncConnectorRunStatus | Select-Object ConnectorName, RunProfileName, Result, StartDate, EndDate |
    Sort-Object StartDate -Descending | Select-Object -First 20

For the Synchronization Service database (SQL LocalDB or full SQL), if it becomes corrupted:

1. Stop the ADSync service
2. Check the Application event log for SQL errors from ADSync source
3. For LocalDB corruption, run: SqlLocalDB.exe info ADSync to check instance state
4. If the database is unrecoverable, reinstall Entra Connect in staging mode first, verify the configuration, then promote to active

Before any Entra Connect upgrade or configuration change:

# Export current configuration (creates a JSON backup)
Get-ADSyncGlobalSettings | ConvertTo-Json -Depth 10 | Out-File entra-connect-config-backup.json