8.3 Monitoring Sync with Entra Connect Health

Monitoring Sync with Entra Connect Health

Quick Answer: Microsoft Entra Connect Health is an agent-based monitoring service that reports sync health from your Connect Sync servers (and AD FS / domain controllers, if federated) into a portal where you can review alerts, sync statistics, and object-level errors. Cloud Sync is monitored differently — through the Entra admin center provisioning page and provisioning logs, not the Connect Health portal.

What Connect Health Monitors

The Connect Health agent is installed on each server you want to monitor. It reports to the Connect Health portal in the Entra admin center. It covers three service types:

• Entra Connect Sync — sync service status, sync errors, sync statistics, and alert configuration for the sync server(s)
• AD FS — if you federated with AD FS, Connect Health monitors the AD FS servers and web application proxies for sign-in health
• Entra domain controllers — for environments using password writeback or PTA, Connect Health can monitor the DCs that the agents talk to

The Connect Health Portal

Once the agent is registered against your tenant, the Connect Health blade in the Microsoft Entra admin center shows a tile per service type. Drilling into the Connect Sync service reveals:

• Sync service status — running, stopped, or stalled; last sync start and end times
• Sync error alerts — active alerts ranked by severity; clicking an alert opens the object-level detail
• Sync statistics — counts of adds, updates, deletes, and errors per sync cycle; useful for spotting a sudden spike in failures
• Object-level sync errors — the specific objects that failed, with the error code, the failing attribute, and the object's DN
• Alert configuration — enable email alerts to a distribution list so the on-call receives notifications when an alert is raised

Configuring Email Alerts

Email alerts are configured per service in the Connect Health portal. You add a recipient email address (typically a distribution list) and choose alert categories. Microsoft recommends routing alerts to a monitored mailbox so sync issues surface within minutes rather than at the next manual review.

Monitoring Cloud Sync

Cloud Sync does not use the Connect Health agent. Its monitoring lives in the Entra admin center:

• Provisioning page — the Entra ID → Provisioning → Cloud Sync blade shows each configuration's status (healthy, quarantined, in-progress) and the last cycle time
• Provisioning logs — per-object logs of what was created, updated, disabled, or failed, filterable by date and status; the equivalent of Connect Sync's object-level error view
• Quarantine state — when a configuration hits repeated errors (for example, bad credentials or a duplicate-attribute storm), Cloud Sync quarantines the configuration and surfaces it on the provisioning page

Use the provisioning logs to triage Cloud Sync errors; they show the source object, target object, action, and reason for each event.

Identifying and Prioritizing Errors

Not every sync error is an emergency. Prioritize by impact:

1. Service-down errors — the sync service is stopped or stalled; no objects are flowing. Investigate immediately.
2. Bulk validation failures — a configuration change caused a wave of attribute-validation errors. Roll back the change, then re-run a sync cycle.
3. Duplicate-attribute conflicts — typically affect the most users because they cluster around shared attributes (UPN, proxyAddress). Fix the source, then let the next delta cycle retry.
4. Single-object errors — usually low impact but watch for patterns; a pattern of InvalidMail errors across one OU suggests a common bad value.

The sync statistics view helps you spot trends — a sudden jump in the error count column is an early signal even before users call the help desk.

Monitoring Hygiene

A few habits keep monitoring useful:

• Verify the Connect Health agent is running on every sync server after OS patching reboots
• Periodically review the alert recipients list — stale distribution lists mean missed alerts
• For Cloud Sync, check the provisioning page after any on-prem AD schema or attribute change that could affect mapping
• Correlate spikes in sync error counts with recent changes (new sync rules, attribute mappings, or AD migrations) to localize root cause faster

Prerequisites, Roles, and Licensing

The Connect Health agent runs on a supported Windows Server hosting the Connect Sync engine (or AD FS / DC). Install it from the Entra admin center's Connect Health blade and register it with Global Administrator credentials; afterward, day-to-day monitoring needs only a role such as Hybrid Identity Administrator or Security Reader to view the portal — Global Admin is not required to read alerts. Connect Health itself does not carry an additional license for sync monitoring, but AD FS and DC monitoring ship with the Entra ID features available in most Microsoft 365 enterprise plans. Keep the agent current: Microsoft updates it alongside Connect Sync, and an out-of-date agent can stop reporting without an obvious on-prem symptom.

Alert Severity and Triage

Connect Health alerts carry severity levels that map to urgency: a sync-service-stopped alert is high severity and should page on-call immediately, while a single-object validation error is typically informational and can be batched for the daily review. Treat a sustained rise in the error-count column as a warning even when no individual alert fires — the statistics view often surfaces degrading sync before a hard alert triggers. Pair Connect Health alerts with the Message Center so a Microsoft-side service incident is not misdiagnosed as an on-prem sync failure.