Upgrade Microsoft Entra Connect Best Way

If your Microsoft Entra Connect server is running anything older than version 2.5.79.0, put September 30, 2026, on your calendar. You need to upgrade Microsoft Entra Connect. Microsoft has confirmed that synchronization stops working entirely past that date if you haven’t upgraded. This isn’t a routine “nice to have” release — it’s a hard cutoff tied to a back-end service hardening change Microsoft shipped in May 2025, and it applies regardless of whether Auto Upgrade is enabled on your server.

The upgrade itself is quick, and the wizard does most of the work. The parts worth doing carefully are the ones around it: exporting your current configuration before you touch anything, confirming which version you’re actually on before and after, and knowing which of the old troubleshooting steps you can skip because Microsoft has since fixed the thing that made them necessary.

How do you upgrade Microsoft Entra Connect?

Export your current configuration from the Microsoft Entra Connect wizard, confirm your installed version, then download the latest installer from the Microsoft Entra admin center — it’s no longer distributed from a generic download page — and run it. The setup detects the existing installation, walks you through re-authenticating with your Microsoft Entra credentials, and upgrades the sync engine in place. If you’re below version 2.5.79.0, this isn’t optional after September 30, 2026 — sync stops until you do it.

Export your configuration first

Before changing anything, confirm your backup software actually ran successfully against the Microsoft Entra Connect server, and export the current configuration as a safety net.

1. Sign in to the Microsoft Entra Connect server.

2. Start Microsoft Entra Connect Sync from the Start menu.

3. Select Configure.

4. Select View or export current configuration, then Next.

5. Select Export Settings.

6. Save the resulting .json file somewhere other than the Entra Connect server itself.

This file won’t let you “restore” a broken upgrade by itself, but it documents exactly how sync rules, filtering, and connectors were configured — which is what you actually need if you have to rebuild the configuration by hand later.

Check what you’re currently running

Two ways to do this. Through the GUI:

1. Open Control Panel > Programs and Features.
2. Find Microsoft Entra Connect Sync and read the version column.

Through PowerShell, which is faster if you’re checking more than one server:

Import-Module ADSync
(Get-ADSyncGlobalSettingsParameter | Where-Object { $_.Name -eq 'Microsoft.Synchronize.ServerConfigurationVersion' }).ValueCode language: JavaScript (javascript)

While you’re in there, check whether Auto Upgrade actually did anything on this server — it frequently doesn’t, even when enabled:

Get-ADSyncAutoUpgrade -Detail

If Auto Upgrade is suspended, this returns the reason. A stalled auto-upgrade is usually why an admin discovers they’re three versions behind right before a deadline like this one.

Do you still need to fix TLS 1.2 first?

Older guides for this upgrade — including earlier versions of this one — walk through manually enabling TLS 1.2 via a registry script before running setup, because versions between 2.3.20.0 and 2.4.129.0 would block installation with an Incorrect version of TLS error if the server wasn’t configured for it.

Microsoft has since closed that gap: version 2.4.131.0 and later no longer require TLS enforcement before installation or upgrade, because every Windows Server version currently supported for Entra Connect already defaults to TLS 1.2. If you’re upgrading from 2.4.131.0 or newer, skip this step entirely — the registry workaround is dead weight at this point. If you’re jumping from something older than that, you’ll still hit the same wall the old guides describe, and the fix is the same: enable TLS 1.2 in the registry, reboot, then run setup.

Download and run the upgrade

The installer isn’t hosted on a generic Microsoft download page anymore — it’s distributed exclusively through the Microsoft Entra admin center, under Entra Connect provisioning.

Before you run it, worth a quick sanity check on the server itself: Microsoft now recommends Windows Server 2025 or Windows Server 2022 for new and upgraded installs. Older supported versions still work, but require a paid extended support program to stay in a fully supported state — not something you want to discover mid-upgrade on a Server 2016 box.

1. Download AzureADConnect.msi from the Entra admin center and save it locally, for example in C:\Install.

2. Run the installer and let it extract. It detects the existing installation and offers to upgrade rather than reinstall from scratch.

During the upgrade, synchronization pauses, then a full sync runs between on-premises AD and Microsoft Entra ID once it’s done. If you’re managing more than 50,000 AD objects, plan this outside business hours — a full sync at that scale can run for a couple of hours.

3. Select Upgrade and let the sync engine update.

4. Sign in with credentials that can manage Microsoft Entra Connect. Global Administrator works, but if you’ve already scoped things down, a Hybrid Identity Administrator account is enough for the upgrade itself and is the better security practice — no reason to hand a sync server your Global Admin credentials if it doesn’t need them.

5. Check Start the synchronization process when configuration completes, then select Upgrade.

6. Once it finishes, select Exit.

7. Open Microsoft Entra Connect Synchronization Service Manager and confirm the sync status shows success rather than an error state.

Verify the new version

Same two options as before. In Synchronization Service Manager:

1. Click Start, search Synchronization, open Synchronization Service.
2. Select Help > About.

Or with the same PowerShell one-liner from earlier:

Import-Module ADSync
(Get-ADSyncGlobalSettingsParameter | Where-Object { $_.Name -eq 'Microsoft.Synchronize.ServerConfigurationVersion' }).ValueCode language: JavaScript (javascript)

Confirm the number is at or above 2.4.21.0 if you’re doing this specifically to clear the September 30 deadline — landing on something still below that line means the upgrade didn’t fully take, or you downloaded an older cached installer by mistake.

If you’re maintaining a staging server alongside your active one, verify both. A staging server sitting on an old version doesn’t stop production sync, but it will surprise you the day you need to fail over to it.

Frequently Asked Questions

References

Microsoft — Microsoft Entra Connect: Prerequisites and hardware https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-prerequisites

Microsoft — Microsoft Entra Connect: Version release history https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-version-history

Microsoft — TLS 1.2 enforcement for Microsoft Entra Connect https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-tls-enforcement

Read more: Microsoft 365 Intune Remote Help Now Supports Unattended Windows Access