Entra Connect Sync: without an upgrade, synchronization stops on April 7, 2027

What Microsoft requires by April 7, 2027

The notice has sat at the top of the Microsoft Entra Connect documentation since late September 2026: upgrade Entra Connect Sync to version 2.6.84.0 or later and configure application-based authentication by April 7, 2027. After that date, legacy authentication is retired and synchronization services stop working until both conditions are met.

This notice replaces an earlier one that set the deadline at September 30, 2026, with version 2.5.79.0 as the minimum. Microsoft gave six more months but raised the bar: 2.5.79.0 is no longer enough, and it left support on October 23, 2026 anyway. The rule itself hasn't changed: each 2.x version is supported for 12 months after the next one ships.

Upgrading Entra Connect Sync: the version alone isn't enough

Here's the trap. Since version 2.6.84.0, released July 7, 2026, Entra Connect Sync no longer switches an existing server to application-based authentication on its own. Auto-upgrade installs the new version, then stops. A server can show 2.6.92.0 and still authenticate with the old account.

One PowerShell command tells you where you stand: Get-ADSyncEntraConnectorCredential. If the identity type reads ServiceAccount, the work isn't done. You need to rerun the wizard and pick the task 'Configure application-based authentication to Microsoft Entra ID'. New installations, on the other hand, are set up this way from the start.

Why Microsoft is retiring the old account

Until now, the server authenticated with the Microsoft Entra Connector account: a user account, a generated password that never expires, and the Directory Synchronization Accounts role. A permanent, highly privileged secret on a server nobody watches: a prime target in a hybrid environment.

Application-based authentication replaces that password with an application identity and a certificate. In managed mode, the certificate lives 90 days, the scheduler renews it on its own, and the private key stays protected by the server's TPM chip when there is one. Once the transition is validated, the old account is removed with Remove-ADSyncAADServiceAccount.

What happens if the date passes

Your users won't notice anything on the morning of April 8: their accounts are already in Entra ID. The problem builds in silence.

• New accounts created in Active Directory no longer show up in the cloud.
• Password changes made on premises no longer propagate.
• An account disabled in Active Directory stays active in Microsoft 365: the departed employee who keeps their access.

Cloud Sync: Microsoft's direction, not an obligation

Microsoft's decision guide, updated October 6, 2026, is clear: Entra Cloud Sync is the strategic direction for hybrid synchronization, and new features are built there first. Version 2.6.91.0, from September 16, 2026, adds a guided migration wizard, offered in waves to eligible tenants.

Eligible means: a single forest, at most 2,000 objects in scope, at most 30 organizational units per domain, and none of the blocking features (custom synchronization rules, group filtering, custom UPN, directory extensions, device synchronization). Domains with more than 150,000 objects, groups with more than 50,000 members, cross-forest references, and PTA or AD FS configuration through the wizard remain Connect Sync territory.

No retirement date for Connect Sync has been announced, and a temporary exception can be requested from Microsoft Support, with no guarantee. In other words: the April 2027 upgrade applies to you regardless; the move to Cloud Sync only if your configuration fits.

The plan, in four moves

• Inventory every Entra Connect server, active and staging, with its version and identity type. The server nobody has touched since 2023 exists more often than you'd think.
• Upgrade to 2.6.92.0 from September 23, 2026, a security hotfix Microsoft recommends installing without delay, rather than to the bare minimum.
• Configure application-based authentication, confirm the identity type, then remove the old account after a validation period. Since 2.6.91.0, Entra Connect requests Microsoft Graph permissions: review Conditional Access policies scoped to applications.
• Decide on Cloud Sync: if you're eligible and in a wave, the guided wizard handles the transition and puts Connect Sync in staging mode. Microsoft recommends keeping it for two weeks before uninstalling. Otherwise, document why you're staying, and when you'll revisit the question.

The server nobody looks at

Entra Connect Sync is the service you install once and forget, because it works. It's also the one that ties your Active Directory to all of Microsoft 365. A hybrid identity review, done now, can be planned. Finding out on April 8 that synchronization has stopped cannot. The io4 team does this review: server inventory, upgrade, authentication switch, and Cloud Sync eligibility.