Home / Azure

AzureTroubleshootingIntermediate

Microsoft Entra Connect Sync errors - fixing duplicate attributes, soft-match failures and stalled sync cycles

Hybrid users not appearing or not updating in Entra ID usually comes from a stopped scheduler, a connector error or per-object export errors such as AttributeValueMustBeUnique. Check the scheduler, run a delta sync and fix the object errors.

Deepak Bhardwaj4 min read

Applies toMicrosoft Entra Connect Sync (formerly Azure AD Connect) 2.x on Windows Server; ADSync PowerShell module

Symptoms

  • A new AD user doesn't appear in Entra ID, or attribute changes (department, UPN, manager) don't arrive.
  • The Entra admin center shows "Sync errors" in Entra Connect Health, or an email reports export errors.
  • The last successful sync time in the portal is hours or days old.

Work through three layers: is the sync engine running, are the connectors healthy, and which objects are failing to export.

1. Is sync running?

On the Entra Connect server, in an elevated PowerShell session:

Import-Module ADSync
Get-ADSyncScheduler

Check these fields:

Field Healthy value
SyncCycleEnabled True
StagingModeEnabled False (on the active server)
SchedulerSuspended False
NextSyncCycleStartTimeInUTC Within the next ~30 minutes

If the scheduler is disabled, enable it:

Set-ADSyncScheduler -SyncCycleEnabled $true

Warning

If StagingModeEnabled is True, this server doesn't export anything to Entra ID. Confirm which server is meant to be active before changing staging mode. Two active servers cause conflicting writes.

Also check that the ADSync Windows service is running and that the server can reach Entra ID endpoints (proxy or firewall changes often break it).

2. Run a delta sync and read the run status

Start-ADSyncSyncCycle -PolicyType Delta

# wait a few minutes, then:
Get-ADSyncConnectorRunStatus

To see the recent runs per connector and their results, open Synchronization Service Manager (miisclient.exe) > Operations. Each run profile (Import, Delta Synchronization, Export) shows a status such as success, completed-export-errors or stopped-server-down.

Run status Meaning
success Nothing to fix
completed-*-errors Some objects failed; click the run to see them
stopped-extension-dll-exception / stopped-server-down Can't reach AD or Entra ID; check credentials and network
no-start-connector-busy Previous run still in progress

Run a full sync only after a configuration change such as new sync rules or OU filtering:

Start-ADSyncSyncCycle -PolicyType Initial

3. Fix per-object export errors

AttributeValueMustBeUnique

Two objects have the same userPrincipalName or proxyAddresses value. Entra ID rejects the second.

Find the duplicate in AD:

$addr = "smtp:jane.doe@contoso.com"
Get-ADObject -LDAPFilter "(proxyAddresses=$addr)" -Properties proxyAddresses, objectClass |
  Select-Object Name, ObjectClass, DistinguishedName

Also check cloud-only objects (a cloud user or group can hold the same address):

Connect-MgGraph -Scopes "User.Read.All","Group.Read.All"
Get-MgUser -Filter "proxyAddresses/any(p:p eq 'smtp:jane.doe@contoso.com')"

Remove the address from the wrong object, then run a delta sync.

InvalidSoftMatch

A synced AD user tries to soft-match a cloud user (by UPN or primary SMTP), but the cloud user already has a different ImmutableId (sourceAnchor) or soft-matching is blocked. Check:

Get-MgUser -UserId jane.doe@contoso.com -Property OnPremisesImmutableId, OnPremisesSyncEnabled |
  Select OnPremisesImmutableId, OnPremisesSyncEnabled

If this is a genuine duplicate, decide which account is authoritative. Don't delete a cloud user with mailbox or licence data without checking with the service owner.

ObjectTypeMismatch

The AD object and the matching cloud object are of different types (for example a contact and a user with the same address). Fix the address on one of them.

DataValidationFailed / LargeObject

  • DataValidationFailed: invalid characters or a UPN suffix that isn't a verified domain. Fix the attribute in AD.
  • LargeObject: too many values, typically userCertificate or proxyAddresses. Clean up the old values.

4. Find all objects with errors

The Connect Health "Sync errors" blade lists them with the conflicting object. From the server, export the connector space errors:

# names vary by version; list connectors first
Get-ADSyncConnector | Select Name, Type

# CSExport writes connector space objects with errors to XML
& "$env:ProgramFiles\Microsoft Azure AD Sync\Bin\csexport.exe" "contoso.onmicrosoft.com - AAD" C:\temp\export-errors.xml /f:e

Open the XML or convert it with CSExportAnalyzer.exe in the same folder.

5. Check the service account and password

stopped-extension-dll-exception on the AD connector often means the AD DS connector account password expired or was reset. Update it in the Entra Connect wizard (Configure > Customize synchronization options > change the account credentials) rather than editing the service directly.

Prevent it next time

  • Run a staging-mode server with the same configuration so you can switch over quickly.
  • Keep Entra Connect current; old builds stop being supported.
  • Check UPN suffixes and proxy addresses in provisioning scripts before creating accounts.
  • Alert on Connect Health sync errors and on "last sync older than 3 hours".

Checklist

  • Scheduler enabled, not suspended, not in staging on the active server
  • Delta sync completes without connector errors
  • Duplicate attributes found and removed at source
  • Soft-match conflicts resolved with the service owner
  • Connector account passwords valid
  • Alerts on stale sync and export errors

Related fixes