Entra Connect Sync needs version 2.6.84.0 and application-based authentication by April 7, 2027

From April 7, 2027, Microsoft Entra Connect Sync servers must run version 2.6.84.0 or later and use application-based authentication (ABA). Microsoft says synchronization services fail between that date and the moment you upgrade. For a hybrid tenant, changes in Active Directory then stop reaching Entra ID, password hashes included.

The upgrade is routine. The switch to ABA is not: since 2.6.84.0, Connect no longer moves existing servers over by itself, and the new method brings a certificate that rotates every 90 days.

Key Takeaways

Deadline April 7, 2027: version 2.6.84.0 or later and ABA. Learn’s “expected impacts” text names only the version, but the prerequisites say both requirements apply

ABA replaces the legacy Sync_<Server>_<id> account with a single-tenant app, a certificate and OAuth 2.0 client credentials

Existing servers need the wizard task Configure application-based authentication to Microsoft Entra ID

The default certificate lives 90 days and is rotated by the sync scheduler. A suspended scheduler means no rotation

Each server, staging included, needs its own app registration

I found no Message Center post for this requirement. Confirm it on Learn and in your own Message Center

What must be true

Requirement	Detail
Version	2.6.84.0 or later. Latest on Learn today: 2.6.92.0 (September 23, 2026). Skip 2.6.84.0 itself: upgrades over an existing ADSync database can fail with `0xE0474352`, fixed in 2.6.91.0
Authentication	ABA instead of the legacy directory synchronization account
Server	.NET Framework 4.7.2, TLS 1.2
Role	Hybrid Identity Administrator or higher
Download	Entra admin center only: Microsoft Entra Connect > Get started > Manage tab

Versions 2.5.190.0 and 2.6.1.0 also leave support before the deadline, on February 2 and March 10, 2027.

The change follows from a dedicated first-party app, “Microsoft Entra AD Synchronization Service” (application ID 6bf85cfa-ac8a-4be5-b5de-425a0d0dc016), which appears in your tenant’s Enterprise applications. That is expected. Earlier Message Center steps in the same hardening series are MC1237727 (versions older than 2.5.79.0, September 30, 2026) and MC1263280 (OnPremisesObjectIdentifier updates blocked from July 1, 2026). Neither mentions ABA or April 7, 2027, so linking them to this deadline is my reading, not Microsoft’s statement.

Check and switch

List every Connect Sync server, staging servers and forgotten ones included.
Check the version in Programs and Features, then the authentication method:

Get-ADSyncEntraConnectorCredential

ConnectorIdentityType shows ServiceAccount (legacy) or Application (ABA). The wizard shows the same under Tasks > View or export current configuration.

Upgrade to the latest version.
In the wizard choose Additional tasks > Configure application-based authentication to Microsoft Entra ID. The wizard sets up the default option, managed by Connect. Bring-your-own-certificate and bring-your-own-app are PowerShell only.
Run a sync cycle and confirm ConnectorIdentityType is Application. Only then remove the legacy account with Remove-ADSyncAADServiceAccount (parameters -AADCredential and -Name, the name being Sync_<Server>_<id>). A rollback with Add-ADSyncAADServiceAccount can take up to 15 minutes.

Learn contradicts itself on whether a manual upgrade switches a server automatically. Do not rely on either reading: check after every upgrade. If the wizard cannot configure ABA, it now stops with an error instead of falling back to the legacy account.

Keep the certificate rotating

The scheduler rotates the certificate. Check Get-ADSyncScheduler and make sure SyncCycleEnabled is True on every server. Watch the Application event log for 1011 (70% of lifetime used), 1012 (expired) and 906 with AADSTS700027 in the message, which points to two servers sharing one app. Learn does not document how a staging server’s scheduler state affects rotation, so test it.

Two traps from Learn’s troubleshooting article:

Staging and active servers (or clones) that share a connector account or SyncMachineIdentifier share one app, and one server’s rotation breaks the other. Each needs its own ConnectSyncProvisioning_<Servername>_<SyncMachineIdentifier> app.
With ABA enabled, do not edit the Entra connector in Synchronization Service Manager. Clicking OK on blank fields can break the next rotation. The repair is Repair-ADSyncToolsEntraAppParameters (ADSyncTools 2.3.0 or later).

Security: the sync identity is now an app, and Application Administrator can add credentials to it and act as it. Keep that role small and PIM-eligible, and alert on credential changes to the ConnectSyncProvisioning_* apps. If the setup is simple, consider Cloud Sync instead. Microsoft recommends migrating if you are eligible, and 2.6.91.0 adds a guided migration workflow in the public cloud.

Check this before April 7, 2027

Every Connect Sync server is listed, staging included
All servers run the latest version, not 2.6.84.0
Get-ADSyncEntraConnectorCredential shows Application on each of them
Each server has its own app registration
SyncCycleEnabled is True everywhere
Alerts exist for events 1011, 1012 and 906
The legacy account is removed after a clean sync cycle
Your own Message Center is searched for newer posts on this

Frequently asked questions

Does auto-upgrade handle this? No. It is occasional and only where supported, and since 2.6.84.0 Connect no longer switches existing servers to ABA by itself. Check each server and run the wizard task where it still uses the legacy account.

What breaks on April 7 if I do nothing? Per Microsoft, synchronization services fail until you upgrade. Changes in Active Directory stop reaching Entra ID.

Does a staging server need ABA too? Yes, with its own app registration. A shared app breaks the active server when the certificate rotates.

Is Cloud Sync a way out? For eligible environments, yes. Run the assessment first, because Cloud Sync does not cover every Connect Sync scenario.