If your organization uses Microsoft Entra Connect Sync to keep on-premises Active Directory in sync with Microsoft Entra ID (formerly Azure AD), Microsoft’s current documentation includes a hard deadline that SMB administrators should put on their calendars now: April 7, 2027. After that date, synchronization can stop working entirely for organizations that haven’t upgraded and reconfigured authentication.
This article explains what Microsoft’s documentation actually says about this deadline, how it relates to an earlier recommended deadline in 2026, what happens if you miss it, and how to check where your environment currently stands.
The mandatory requirement: version 2.6.84.0 and application-based authentication by April 7, 2027
Across multiple current Microsoft Learn pages, Microsoft states the same requirement using near-identical wording:
Mandatory upgrade required: Upgrade Microsoft Entra Connect Sync to version 2.6.84.0 or later and configure application-based authentication by April 7, 2027. Legacy authentication is being retired, and synchronization services will stop working after this date if these requirements aren’t met.
This requirement has two parts, and both need to be in place:
- Version – Your Entra Connect Sync server must be running version 2.6.84.0 or later.
- Authentication method – The server must be configured to use application-based authentication rather than the legacy directory synchronization account method.
What “application-based authentication” means here
Microsoft’s documentation explains that it has deployed a dedicated first-party application to handle synchronization between Active Directory and Microsoft Entra ID. This application appears as a service principal named “Microsoft Entra AD Synchronization Service” (Application ID 6bf85cfa-ac8a-4be5-b5de-425a0d0dc016) in the Enterprise Applications section of the Microsoft Entra admin center. Newer releases of Entra Connect Sync support this authentication model, and Microsoft describes it as critical to keeping synchronization functioning going forward as legacy authentication is retired.
What happens if you don’t upgrade in time
According to Microsoft’s documentation, if an environment isn’t on the minimum required version when the change takes effect, all synchronization services in Microsoft Entra Connect Sync will fail. If synchronization stops because the deadline was missed, Microsoft states that upgrading to the latest version and configuring application-based authentication restores service — but synchronization remains failed for the entire period between April 7, 2027, and whenever the upgrade is completed.
In other words, this isn’t a feature that quietly degrades. Based on the documented wording, sync either keeps working (because you met the requirement) or it stops entirely until you fix it.
A separate, earlier recommended deadline: September 30, 2026
It’s easy to conflate the April 2027 mandatory deadline with a different, earlier date that also appears in Microsoft’s documentation: September 30, 2026.
Since September 2023, Microsoft has been automatically upgrading Entra Connect Sync and Entra Connect Health customers to updated builds as part of what it describes as a “precautionary security-related service change.” Customers who were auto-upgraded aren’t affected by this particular change. However, for customers who opted out of auto-upgrade, or whose auto-upgrade failed, Microsoft’s documentation strongly recommends upgrading to the latest versions by September 30, 2026, to avoid service impact.
The minimum versions associated with this September 2026 recommendation are:
- Microsoft Entra Connect: 2.6.84.0 or higher
- Microsoft Entra Connect Health Connect Sync agent: 4.5.2466.0 or higher
- Microsoft Entra Connect Health AD DS agent: 4.5.2466.0 or higher
- Microsoft Entra Connect Health AD FS agent: 4.5.2466.0 or higher
Microsoft’s documentation frames the September 2026 date as a strong recommendation tied to an earlier hardening effort, distinct from the April 7, 2027 date, which is described as mandatory and tied specifically to the retirement of legacy authentication. Practically speaking, administrators who get onto 2.6.84.0 or later and configure application-based authentication well before 2027 will naturally satisfy both requirements.
Why Microsoft is making this change
Microsoft’s documentation frames this as part of an ongoing effort to increase the security posture of Entra Connect. The shift to a dedicated first-party synchronization application and application-based authentication replaces the older directory synchronization account model. Microsoft’s guidance also notes that it occasionally auto-upgrades eligible customers to help with this transition — but for auto-upgrade to work at all, a server needs to already be on version 2.3.20.0 or higher. Environments running older, unsupported releases won’t be auto-upgraded and will need a manual upgrade path instead.
End of support for version 2.5.79.0
If your organization is running Entra Connect Sync 2.5.79.0, Microsoft’s official version release history lists the following:
- Release date: 1 September 2025
- End of support date: 23 October 2026 (12 months after the release of version 2.5.190.0)
Microsoft’s retirement policy for Entra Connect Sync 2.x versions, in effect since 15 March 2023, ties each version’s end-of-support date to 12 months after the release of the next version. Running a retired version carries documented risk: Microsoft states that retired versions “might unexpectedly stop working,” won’t receive the latest security fixes, performance improvements, or diagnostic tools, and that support may be limited for organizations that need it.
For context, the version history also documents these milestones relevant to the upgrade path toward the April 2027 requirement:
| Version | Release date | End of support date |
|---|---|---|
| 2.5.79.0 | 1 Sep 2025 | 23 Oct 2026 |
| 2.5.190.0 | 19 Nov 2025 | 2 Feb 2027 |
| 2.6.1.0 | 2 Feb 2026 | 10 Mar 2027 |
| 2.6.3.0 | 10 Mar 2026 | 7 Jul 2027 |
| 2.6.84.0 | 7 Jul 2026 | 16 Sep 2027 |
Because 2.6.84.0 is the minimum version named in the mandatory April 2027 requirement, and it has its own later end-of-support date, upgrading directly to 2.6.84.0 or a newer build addresses both the version-history retirement risk and the mandatory authentication deadline at once.
Confirming your installed version and getting the current release
Microsoft’s documentation states that the Microsoft Entra Connect Sync .msi installation file is exclusively available through the Microsoft Entra admin center, under the Manage tab of the Microsoft Entra Connect “Get started” page. It is not distributed through other download channels.
To identify which version is current and compare it against your environment, Microsoft maintains an official version release history page listing every release, its release date, and its end-of-support date. This is the authoritative reference for checking whether a given build is still supported.
Microsoft’s published documentation in this source set does not describe a specific step-by-step method for checking the version currently installed on a given server. As a practical recommendation (not a documented Microsoft procedure), administrators should treat version verification as part of normal change-management practice before the 2027 deadline — confirm what’s installed, compare it against the version history page, and plan the upgrade path accordingly rather than assuming auto-upgrade has already handled it.
Minimum technical requirements to be aware of
Microsoft’s mandatory upgrade notices specify that organizations should “meet the minimum requirements including .NET Framework 4.7.2 and TLS 1.2” when upgrading toward the April 2027 requirement. Separately, Microsoft’s general prerequisites documentation for installing Entra Connect states that the baseline minimum .NET Framework version for installation is 4.6.2 (with newer versions, including 4.8, also supported and recommended for better accessibility compliance). Administrators planning an upgrade specifically for the April 2027 deadline should treat 4.7.2 and TLS 1.2 as the relevant baseline called out alongside that requirement, and verify current prerequisites before upgrading.
Should you consider Microsoft Entra Cloud Sync instead?
Across several of these documentation pages, Microsoft recommends that eligible customers consider migrating from Entra Connect Sync to Microsoft Entra Cloud Sync instead of continuing to maintain an on-premises sync server. Microsoft describes Cloud Sync as a cloud-managed sync client and states that new features are being introduced there, framing it as a way to avoid future migration cycles. Whether Cloud Sync is suitable depends on your organization’s supported sync scenarios, and Microsoft points administrators to its sync scenario comparison to evaluate eligibility. This is a documented Microsoft recommendation, not a requirement — organizations that remain on Entra Connect Sync simply need to meet the version and authentication requirements described above.
Practical recommendations for SMB admins
The following are practical suggestions based on the documented requirements above, not Microsoft requirements themselves:
- Don’t wait for auto-upgrade alone. Auto-upgrade only applies to eligible configurations and requires a minimum starting version (2.3.20.0) to function at all. Confirm your server qualifies rather than assuming it will be handled automatically.
- Treat September 30, 2026, as your practical internal deadline, even though it’s a recommendation rather than a hard cutoff — it gives you a buffer before the mandatory April 7, 2027 date and reduces the risk of a late, rushed upgrade.
- Plan the authentication reconfiguration, not just the version upgrade. Meeting the version requirement alone is not sufficient; application-based authentication must also be configured.
- If you’re evaluating a larger change anyway (operating system upgrade, server consolidation, or significant configuration changes), Microsoft’s own upgrade guidance describes a swing migration approach — building a new server alongside the existing one — as the more conservative option compared to an in-place upgrade.
Conclusion
Microsoft’s documentation is clear and consistent across multiple pages: Entra Connect Sync environments need to be running version 2.6.84.0 or later with application-based authentication configured by April 7, 2027, or synchronization will stop. A separate, earlier recommended date of September 30, 2026 applies to a related security hardening effort and effectively overlaps with the same minimum version. Version 2.5.79.0 specifically reaches end of support on October 23, 2026, adding another reason not to delay.
For SMB administrators managing hybrid identity, the practical takeaway is straightforward: confirm your current version against Microsoft’s official version history, plan the upgrade and authentication reconfiguration well ahead of either deadline, and evaluate whether Cloud Sync is a better long-term fit for your environment. As with any infrastructure change affecting identity synchronization, this article should be used as a starting point for planning — verify current details directly against Microsoft’s documentation before making changes in production, since Microsoft continues to update these pages as new releases ship.