Field note
Entra Connect Sync: September 2026 Deadline
Hybrid identity often works quietly enough to become invisible. That makes a version deadline dangerous: the business remembers the sync server only when new starters, passwords, or group changes stop flowing.
Microsoft says all Microsoft Entra Connect Sync synchronisation services will stop working on 30 September 2026 if the installed version is older than 2.5.79.0.
Version 2.5.79.0 is the minimum for this specific service deadline, not a target version to install in September. Microsoft continues to publish later releases and support dates. The safe target is a currently supported release that fits your environment.
Quick answer
If you synchronise on-premises Active Directory identities into Microsoft Entra ID:
- Identify every active and staging Connect Sync server.
- Record its exact installed version and Windows Server state.
- Check whether the version is currently supported, not only whether it meets 2.5.79.0.
- Decide whether to upgrade Connect Sync or migrate a supported scenario to Cloud Sync.
- Test synchronisation, password flow and rollback before 30 September.
- Remove old servers completely when the change is proven.
Do not rely on the server name in an old diagram. Check the live synchronisation estate.
Why the minimum version matters
Microsoft states that version 2.5.79.0 introduced a back-end service change that hardens the service. Below that minimum, synchronisation services will fail after the deadline until the installation is upgraded.
The visible business effects can include:
- new users not appearing in Microsoft 365
- group membership changes not arriving
- password hashes or other identity changes becoming stale
- disabled on-premises accounts remaining active in the cloud longer than expected
- helpdesk teams troubleshooting separate applications instead of the shared identity dependency
The last successful sync time should already be monitored. A September upgrade should not be the first time anyone checks it.
Upgrade or move to Cloud Sync?
Microsoft tells customers to assess whether Cloud Sync is appropriate before simply upgrading Connect Sync. Cloud Sync uses lightweight provisioning agents, keeps configuration in the cloud and supports multiple active agents.
It is not a drop-in match for every Connect Sync deployment.
Microsoft's supported-scenarios table shows examples where Connect Sync is still required, including:
- Microsoft Entra hybrid join
- user accounts in one forest with mailboxes in a resource forest
- domains with more than 250,000 objects
- filtering directory objects by attribute values
Cloud Sync supports other useful scenarios, including disconnected forests and high availability through multiple agents. Exchange hybrid is supported, but the detailed topology and feature requirements still need checking.
Choose the tool from the documented scenario, not from the appeal of removing a server.
Pre-change evidence
Capture these before touching the installation:
| Evidence | What to record |
|---|---|
| Server inventory | Active, staging and powered-off legacy servers |
| Installed version | Exact Connect Sync build on each server |
| Configuration | Forests, domains, OU filters, custom rules, optional features |
| Sync health | Last success, errors, connector state and scheduler state |
| Authentication | Password hash sync, pass-through authentication or federation dependencies |
| Recovery | Staging server, configuration export and change window |
Custom synchronisation rules deserve special attention. Microsoft warns that changes to out-of-box rules can affect upgrade behaviour and may cause a full import and full synchronisation.
A safer change path
For an older or heavily customised deployment, Microsoft describes a swing migration as the conservative approach. A new staging server is prepared and verified before it becomes active.
A practical sequence is:
- Confirm prerequisites for the current supported release.
- Export and review the live configuration.
- Prepare the updated staging server or Cloud Sync pilot.
- Run full import and synchronisation where required.
- Review pending changes before activating the new path.
- Test a joiner, mover, leaver and password-change scenario.
- Monitor sync health and Entra objects after cutover.
- Decommission the former server fully when rollback is no longer required.
Microsoft specifically warns about old Connect servers being left on the network. A rogue server can later resume and overwrite cloud attributes with stale values. Powering it off and forgetting it is not a clean decommissioning plan.
What to test
Do not limit acceptance to "the service is running".
Test:
- a new in-scope user
- a changed display name or other normal attribute
- an in-scope group membership change
- a disabled user
- password synchronisation if used
- excluded OUs or objects remaining excluded
- any custom attribute or application dependency
- alerting when synchronisation fails
Record expected and actual results with timestamps. This gives the helpdesk something concrete to use if an identity issue appears later.
Evidence to keep
The closeout pack should contain the old and new version, configuration export, sync-health evidence, test results, change approval, named owner and decommissioning record.
The deadline is firm enough to act on now. The architecture decision still deserves care. Upgrade safely if Connect Sync is the right tool; migrate only where Microsoft's supported scenarios match the estate you actually run.
Related route
Hybrid identity version work often uncovers old service accounts, policy gaps and unclear emergency access. Tie those findings into an Entra ID and Conditional Access review.
References
Related notes
11 Jul 2026 · 4 min
Related: conditional access, resource exclusions, microsoft entra id.
11 Jul 2026 · 5 min
Related: exchange online, ews retirement, ewsallowedappids.
11 Jul 2026 · 5 min
Related: smtp auth, exchange online, basic authentication.
Need help mapping this to your own tenant, controls, or assessment timeline?