Directory & Authentication - Microsoft Entra Connect Password Hash Sync Status

Monitoring Benefit

The Microsoft Entra Connect Password Hash Sync status test confirms that password hash synchronisation is enabled and running between your on-premises Active Directory and Microsoft Entra ID.

This check matters more than its name suggests. When password hash sync stops, nothing breaks immediately — existing sessions continue and cached credentials keep working. The failure surfaces later, as users who have changed their on-premises password find the old one still works in the cloud, or the new one does not. By then the cause is several days behind the symptom. It is also the fallback authentication path if federation or pass-through authentication fails, so a silent failure here removes a safety net you may be relying on without knowing it.

How do we verify the monitoring test results?

Run these on the Microsoft Entra Connect server itself, in an elevated PowerShell session.

Is password hash sync enabled?

Import-Module ADSync
Get-ADSyncAADCompanyFeature

The PasswordHashSync property should read True. If it reads False, the feature is switched off at the tenant level and no amount of investigation on the connector will change that.

Is the sync scheduler actually running?

Get-ADSyncScheduler

Check SyncCycleEnabled is True and that NextSyncCyclePolicyType and NextSyncCycleStartTimeInUTC look sensible. A scheduler left disabled after maintenance is a common cause — it is a single command to disable and easy to forget to re-enable.

Confirm in the portal

In the Microsoft Entra admin center, go to Identity > Hybrid management > Microsoft Entra Connect > Connect Sync. It shows whether password hash sync is enabled and when the last synchronisation ran. Compare the last sync time against the interval ENow is checking.

Test a single account end to end

The Entra Connect wizard includes a troubleshooting task that traces password hash sync for one named user and reports where it is failing. Launch the Entra Connect wizard, choose Troubleshoot, then the password hash synchronisation option. This is the fastest way to distinguish a tenant-wide failure from a single object that is not syncing.

Common warning or error results, and potential solutions

• PasswordHashSync reports False. The feature is disabled for the tenant. Re-enable it through the Entra Connect wizard rather than by editing the connector directly.
• Enabled, but the last sync time is old. Check Get-ADSyncScheduler first — a disabled scheduler stops everything, not just password sync. If the scheduler is running, look at the Application event log on the Connect server for synchronisation errors.
• Most users sync but one does not. Usually a single object problem rather than a service problem — a duplicate attribute, a filtered object, or an object in an organisational unit excluded from sync scope. Use the wizard's troubleshooting task on that user.
• The check failed after a Connect server upgrade or migration. Staging mode is often left enabled after a migration. A server in staging mode synchronises nothing to the tenant.
• Older guidance references a Get-PasswordHashSyncConfiguration script. That script was distributed through the TechNet Gallery, which Microsoft has shut down. Use Get-ADSyncAADCompanyFeature instead.

References:

Implement password hash synchronization with Microsoft Entra Connect Sync | Microsoft Learn

Troubleshoot password hash synchronization | Microsoft Learn