- Article
- 8 minutes to read
This topic describes the built-in scheduler in Azure AD Connect sync (sync engine).
This feature was introduced with build 1.1.105.0 (released February 2016).
Overview
Azure AD Connect sync synchronize changes occurring in your on-premises directory using a scheduler. There are two scheduler processes, one for password sync and another for object/attribute sync and maintenance tasks. This topic covers the latter.
In earlier releases, the scheduler for objects and attributes was external to the sync engine. It used Windows task scheduler or a separate Windows service to trigger the synchronization process. The scheduler is with the 1.1 releases built-in to the sync engine and do allow some customization. The new default synchronization frequency is 30 minutes.
The scheduler is responsible for two tasks:
- Synchronization cycle. The process to import, sync, and export changes.
- Maintenance tasks. Renew keys and certificates for Password reset and Device Registration Service (DRS). Purge old entries in the operations log.
The scheduler itself is always running, but it can be configured to only run one or none of these tasks. For example, if you need to have your own synchronization cycle process, you can disable this task in the scheduler but still run the maintenance task.
Important
By default every 30 minutes a synchronization cycle is run. If you have modified the synchronization cycle you will need to make sure that a synchronization cycle is run at least once every 7 days.
- A delta sync needs to happen within 7 days from the last delta sync.
- A delta sync (following a full sync) needs to happen within 7 days from the time the last full sync completed.
Failure to do so may cause synchronization issues which will require you to run a full synchronization to resolve. This also applies to servers in Staging mode.
Scheduler configuration
To see your current configuration settings, go to PowerShell and run Get-ADSyncScheduler. It shows you something like this picture:
If you see The sync command or cmdlet is not available when you run this cmdlet, then the PowerShell module is not loaded. This problem could happen if you run Azure AD Connect on a domain controller or on a server with higher PowerShell restriction levels than the default settings. If you see this error, then run Import-Module ADSync to make the cmdlet available.
- AllowedSyncCycleInterval. The shortest time interval between synchronization cycles allowed by Azure AD. You cannot synchronize more frequently than this setting and still be supported.
- CurrentlyEffectiveSyncCycleInterval. The schedule currently in effect. It has the same value as CustomizedSyncInterval (if set) if it is not more frequent than AllowedSyncInterval. If you use a build before 1.1.281 and you change CustomizedSyncCycleInterval, this change takes effect after next synchronization cycle. From build 1.1.281 the change takes effect immediately.
- CustomizedSyncCycleInterval. If you want the scheduler to run at any other frequency than the default 30 minutes, then you configure this setting. In the picture above, the scheduler has been set to run every hour instead. If you set this setting to a value lower than AllowedSyncInterval, then the latter is used.
- NextSyncCyclePolicyType. Either Delta or Initial. Defines if the next run should only process delta changes, or if the next run should do a full import and sync. The latter would also reprocess any new or changed rules.
- NextSyncCycleStartTimeInUTC. Next time the scheduler starts the next sync cycle.
- PurgeRunHistoryInterval. The time operation logs should be kept. These logs can be reviewed in the synchronization service manager. The default is to keep these logs for 7 days.
- SyncCycleEnabled. Indicates if the scheduler is running the import, sync, and export processes as part of its operation.
- MaintenanceEnabled. Shows if the maintenance process is enabled. It updates the certificates/keys and purges the operations log.
- StagingModeEnabled. Shows if staging mode is enabled. If this setting is enabled, then it suppresses the exports from running but still run import and synchronization.
- SchedulerSuspended. Set by Connect during an upgrade to temporarily block the scheduler from running.
You can change some of these settings with Set-ADSyncScheduler. The following parameters can be modified:
- CustomizedSyncCycleInterval
- NextSyncCyclePolicyType
- PurgeRunHistoryInterval
- SyncCycleEnabled
- MaintenanceEnabled
In earlier builds of Azure AD Connect, isStagingModeEnabled was exposed in Set-ADSyncScheduler. It is unsupported to set this property. The property SchedulerSuspended should only be modified by Connect. It is unsupported to set this with PowerShell directly.
The scheduler configuration is stored in Azure AD. If you have a staging server, any change on the primary server also affects the staging server (except IsStagingModeEnabled).
CustomizedSyncCycleInterval
Syntax: Set-ADSyncScheduler -CustomizedSyncCycleInterval d.HH:mm:ss
d - days, HH - hours, mm - minutes, ss - seconds
Example: Set-ADSyncScheduler -CustomizedSyncCycleInterval 03:00:00
Changes the scheduler to run every 3 hours.
Example: Set-ADSyncScheduler -CustomizedSyncCycleInterval 1.0:0:0
Changes change the scheduler to run daily.
Disable the scheduler
If you need to make configuration changes, then you want to disable the scheduler. For example, when you configure filtering or make changes to synchronization rules.
To disable the scheduler, run Set-ADSyncScheduler -SyncCycleEnabled $false.
When you've made your changes, do not forget to enable the scheduler again with Set-ADSyncScheduler -SyncCycleEnabled $true.
Start the scheduler
The scheduler is by default run every 30 minutes. In some cases, you might want to run a sync cycle in between the scheduled cycles or you need to run a different type.
Delta sync cycle
A delta sync cycle includes the following steps:
- Delta import on all Connectors
- Delta sync on all Connectors
- Export on all Connectors
Full sync cycle
A full sync cycle includes the following steps:
- Full Import on all Connectors
- Full Sync on all Connectors
- Export on all Connectors
It could be that you have an urgent change that must be synchronized immediately, which is why you need to manually run a cycle.
If you need to manually run a sync cycle, then from PowerShell run Start-ADSyncSyncCycle -PolicyType Delta.
To initiate a full sync cycle, run Start-ADSyncSyncCycle -PolicyType Initial from a PowerShell prompt.
Running a full sync cycle can be very time consuming, read the next section to read how to optimize this process.
Sync steps required for different configuration changes
Different configuration changes require different sync steps to ensure the changes are correctly applied to all objects.
- Added more objects or attributes to be imported from a source directory (by adding/modifying the sync rules)
- A Full Import is required on the Connector for that source directory
- Made changes to the Synchronization rules
- A Full Sync is required on the Connector for the changed Synchronization rules
- Changed filtering so a different number of objects should be included
- A Full Import is required on the Connector for each AD Connector UNLESS you are using Attribute-based filtering based on attributes that are already being imported into the sync engine
Customizing a sync cycle run the right mix of Delta and Full sync steps
To avoid running a full sync cycle you can mark specific Connectors to run a Full step using the following cmdlets.
Set-ADSyncSchedulerConnectorOverride -Connector <ConnectorGuid> -FullImportRequired $true
Set-ADSyncSchedulerConnectorOverride -Connector <ConnectorGuid> -FullSyncRequired $true
Get-ADSyncSchedulerConnectorOverride -Connector <ConnectorGuid>
Example: If you made changes to the synchronization rules for Connector “AD Forest A” that don’t require any new attributes to be imported you would run the following cmdlets to run a delta sync cycle which also did a Full Sync step for that Connector.
Set-ADSyncSchedulerConnectorOverride -ConnectorName “AD Forest A” -FullSyncRequired $true
Start-ADSyncSyncCycle -PolicyType Delta
Example: If you made changes to the synchronization rules for Connector “AD Forest A” so that they now require a new attribute to be imported you would run the following cmdlets to run a delta sync cycle which also did a Full Import, Full Sync step for that Connector.
Set-ADSyncSchedulerConnectorOverride -ConnectorName “AD Forest A” -FullImportRequired $true
Set-ADSyncSchedulerConnectorOverride -ConnectorName “AD Forest A” -FullSyncRequired $true
Start-ADSyncSyncCycle -PolicyType Delta
Stop the scheduler
If the scheduler is currently running a synchronization cycle, you might need to stop it. For example if you start the installation wizard and you get this error:
When a sync cycle is running, you cannot make configuration changes. You could wait until the scheduler has finished the process, but you can also stop it so you can make your changes immediately. Stopping the current cycle is not harmful and pending changes are processed with next run.
Start by telling the scheduler to stop its current cycle with the PowerShell cmdlet
Stop-ADSyncSyncCycle.See AlsoAttributes synchronized by Azure AD Connect - Microsoft EntraTroubleshoot OneDrive for Business sync issues - SharePointHow to troubleshoot password synchronization when using an Azure AD sync appliance - Active DirectoryImplement password hash synchronization with Azure AD Connect sync - Microsoft EntraIf you use a build before 1.1.281, then stopping the scheduler does not stop the current Connector from its current task. To force the Connector to stop, take the following actions:
- Start Synchronization Service from the start menu. Go to Connectors, highlight the Connector with the state Running, and select Stop from the Actions.
The scheduler is still active and starts again on next opportunity.
Custom scheduler
The cmdlets documented in this section are only available in build 1.1.130.0 and later.
If the built-in scheduler does not satisfy your requirements, then you can schedule the Connectors using PowerShell.
Invoke-ADSyncRunProfile
You can start a profile for a Connector in this way:
Invoke-ADSyncRunProfile -ConnectorName "name of connector" -RunProfileName "name of profile"The names to use for Connector names and Run Profile Names can be found in the Synchronization Service Manager UI.
The Invoke-ADSyncRunProfile cmdlet is synchronous, that is, it does not return control until the Connector has completed the operation, either successfully or with an error.
When you schedule your Connectors, the recommendation is to schedule them in the following order:
- (Full/Delta) Import from on-premises directories, such as Active Directory
- (Full/Delta) Import from Azure AD
- (Full/Delta) Synchronization from on-premises directories, such as Active Directory
- (Full/Delta) Synchronization from Azure AD
- Export to Azure AD
- Export to on-premises directories, such as Active Directory
This order is how the built-in scheduler runs the Connectors.
Get-ADSyncConnectorRunStatus
You can also monitor the sync engine to see if it is busy or idle. This cmdlet returns an empty result if the sync engine is idle and is not running a Connector. If a Connector is running, it returns the name of the Connector.
Get-ADSyncConnectorRunStatus
In the picture above, the first line is from a state where the sync engine is idle. The second line from when the Azure AD Connector is running.
Scheduler and installation wizard
If you start the installation wizard, then the scheduler is temporarily suspended. This behavior is because it is assumed you make configuration changes and these settings cannot be applied if the sync engine is actively running. For this reason, do not leave the installation wizard open since it stops the sync engine from performing any synchronization actions.
Next steps
Learn more about the Azure AD Connect sync configuration.
Learn more about Integrating your on-premises identities with Azure Active Directory.
FAQs
How to stop Azure AD Connect synchronization scheduler? ›
To disable the built-in sync scheduler: Start a PowerShell session on the Azure AD Connect server. Disable scheduled synchronization by running the cmdlet Set-ADSyncScheduler -SyncCycleEnabled $false .
How frequently does Azure AD Connect sync? ›By default every 30 minutes a synchronization cycle is run. If you have modified the synchronization cycle you will need to make sure that a synchronization cycle is run at least once every 7 days.
How do I check my AD sync schedule? ›Sign in to the Microsoft 365 admin center and choose DirSync Status on the home page. Alternately, you can go to Users > Active users, and on the Active users page, select the Elipse > Directory synchronization.
How do I fix my Azure AD sync problem? ›Run the troubleshooting task in the wizard
Start the Azure AD Connect wizard. Navigate to the Additional Tasks page, select Troubleshoot, and click Next. On the Troubleshooting page, click Launch to start the troubleshooting menu in PowerShell. In the main menu, select Troubleshoot Object Synchronization.
In the 365 portal click Users then Active Users and you will see your accounts have a status of 'Synched with Active Directory'. To disable this synchronisation click Manage. Click Deactivate to start the process.
Does Azure AD Connect update automatically? ›Azure AD Connect automatic upgrade is a feature that regularly checks for newer versions of Azure AD Connect. If your server is enabled for automatic upgrade and a newer version is found for which your server is eligible, it will perform an automatic upgrade to that newer version.
What is the difference between AD Sync and AD connect? ›Azure AD Connect Cloud Sync is the preferred way to synchronize on-premises AD to Azure AD, assuming you can get by with its limitations. Azure AD Connect provides the most feature-rich synchronization capabilities, including Exchange hybrid support.
How do you check if Azure AD Connect is syncing? ›Verifying Azure AD Connect in the Azure AD Admin Center
First, log in to the portal. Then, go to Azure Active Directory —> Azure AD Connect. Under the Azure AD Connect sync section, you should see the current status of the directory sync.
Azure AD Connect is used to synchronize user accounts, group memberships, and credential hashes from an on-premises AD DS environment to Azure AD. Attributes of user accounts such as the UPN and on-premises security identifier (SID) are synchronized.
Can Azure AD sync back to on premise? ›The AD DS directory can be synchronized with Azure AD to enable it to authenticate on-premises users. Azure AD Connect sync server. An on-premises computer that runs the Azure AD Connect sync service. This service synchronizes information held in the on-premises Active Directory to Azure AD.
How many instances of Azure AD Connect are needed? ›
You need one different instance of Azure AD connect for each tenant you want to synchronize with; Azure AD Connect does not allow (yet?) to synchronize with multiple tenant. Only one Azure AD tenant sync can be configure for write-back (groups and/or devices) as well as hybrid Exchange.
How do I force an AD sync cycle? ›- Use the Enter-PSSession command to connect to your Azure AD Connect server.
- Perform a delta synchronization using the Start-ADSyncSyncCycle command.
- Exit the PSSession to kill the connection to your Azure AD Connect server.
If the Delivery column shows a Pending icon, the ad is not running because it is either in draft, pending review, or scheduled for a later time. Hover over the Delivery status to learn more. To run a scheduled ad now, change your schedule. If the Delivery column says Off, the ad has been turned off.
How often does Active Directory sync with Office 365? ›By default, directory sync is performed from the on-premises AD to the Azure AD used by Office 365. However, you can configure Active Directory sync in the reverse direction and synchronize the change from Azure AD to your on-premises AD. By default, synchronization is scheduled to run every 30 minutes.
Why is my Microsoft Sync not working? ›If you're having problems with syncing, you can try running the Microsoft Accounts troubleshooter on the desktop computer and check the status. It's an automated tool that can find and automatically fix some syncing problems.
How do I restart Microsoft Azure AD Sync? ›- Go to Windows Service Control Manager (START → Services).
- Select Microsoft Azure AD Sync and click Restart.
Force AD Sync Using AD Users & Computers
After making the changes to your user account that you want to replicate, select the check box in the bottom left corner of the Office 365 tab: Clicking Apply or OK will force an AD sync immediately.
To disable Azure AD Connect, install the MSOnline (Azure AD v1 PowerShell) module, and then run Set-MsolDirSyncEnabled -EnableDirSync $false. This will disable directory synchronization on your Azure AD tenant and will convert all synchronized objects (DirSyncEnabled = True) to cloud objects(DirsyncEnabled = False).
What is the relationship between Azure AD and Office 365? ›Microsoft 365 uses Azure Active Directory (Azure AD) to manage user identities behind the scenes. Your Microsoft 365 subscription includes a free Azure AD subscription so that you can integrate your on-premises Active Directory Domain Services (AD DS) to synchronize user accounts and passwords or set up single sign-on.
What happens if you uninstall Azure AD Connect? ›Uninstalling the AAD connect does not delete the users or change the auth medium, however, the change in any AAD connect setup is supported if you follow the path to turn off the sync to avoid any issues.
How often does Azure AD Connect sync passwords? ›
The password hash synchronization process runs every 2 minutes. You cannot modify the frequency of this process. When you synchronize a password, it overwrites the existing cloud password.
How long do AD changes take to sync? ›On environments with only one Active Directory (AD) server (domain controller), a change usually takes up to ~5 minutes to get processed and sent to the cloud, barring any issues in regards around network latency, processing and also the size of the organization being synchronized.
How do I update AD Sync connect? ›If you want to install a newer version of Azure AD Connect: close the Azure AD Connect wizard, uninstall the existing Azure AD Connect, and perform a clean install of the newer Azure AD Connect.
What is MS Entra? ›Microsoft Entra is the new name for the family of identity and access technologies now brought into one place and under one portal. Entra goes beyond traditional identity and access management – it's Microsoft's vision for the future of identity and access.
Why should I use Azure AD Connect? ›Azure Active Directory (Azure AD) Connect Health provides robust monitoring of your on-premises identity infrastructure. It enables you to maintain a reliable connection to Microsoft 365 and Microsoft Online Services. This reliability is achieved by providing monitoring capabilities for your key identity components.
Is Azure AD Connect two way? ›Azure AD Connect is a one-way synchronisation from AD to Azure AD. There is no way to configure a two-way sync. It's just not possible at all.
How do I monitor my Azure sync? ›Use the Azure File Sync performance counters on the server to monitor sync activity. To view Azure File Sync performance counters on the server, open Performance Monitor (Perfmon.exe). You can find the counters under the AFS Bytes Transferred and AFS Sync Operations objects.
How do I know if my Azure sync is not working? ›- Sign in to the Microsoft 365 admin center with a global administrator account.
- On the Home page, you'll see the User management card.
- On the card, choose Sync errors under Azure AD Connect to see the errors on the Directory sync errors page.
Sync AD objects to multiple Azure AD tenants
AADConnect can synchronize the users, groups, and contacts from a single Active Directory to multiple Azure AD tenants.
Disable automatic synchronization. If you leave auto-sync on, you may find your Android device running low on battery power much quicker than you want. So it's best to turn it off unless you really need it. For more, see the original article at the link below.
What is the difference between Azure AD Connect and ADFS? ›
ADFS can operate without Azure identity management services. It creates endpoints with unique IDs for authentication, which can work across a hybrid environment. Azure Active Directory is a centralized, cloud-based identity as a service (IDaaS) solution which creates multiple directories for each directory service.
How long does Azure AD sync take? ›Once every 30 minutes, the Azure AD synchronization is triggered, unless it is still processing the last run. Runs generally take less than 10 minutes, but if we need to replace the tool, it can take 2-3 days to get into synchronicity. On busy days, it is not uncommon for this process to take several hours to complete.
Can I force an Azure AD Sync? ›Yes it is possible to force a synchronization between on-premise Active Directory (AD) to Azure Active Directory (Azure AD), by using the Start-AdSyncSchedule PowerShell cmdlet from the ADSync PowerShell module.
What is the difference between Azure AD and on Prem AD? ›Services running in on-premises environments normally use AD service accounts or group Managed Service Accounts (gMSA) to run. These apps will then inherit the permissions of the service account. Azure AD provides managed identities to run other workloads in the cloud.
Does Azure AD Sync use SQL? ›Azure AD Connect requires a SQL Server database to store data. You can either use the default SQL Server 2012 Express LocalDB installed with Azure AD Connect or use your own full version of SQL. Previously, when you installed Azure AD Connect, a new database named ADSync was always created.
Does Azure AD Connect need to be on a domain controller? ›"Azure AD Connect must be installed on Windows Server 2008 or later. This server may be a domain controller or a member server when using express settings. If you use custom settings, then the server can also be stand-alone and does not have to be joined to a domain."
Does Azure AD Connect need a VPN? ›Azure AD authentication is supported only for OpenVPN® protocol connections and requires the Azure VPN Client.
Should Azure AD Connect be installed on domain controller? ›Ideally, Azure AD Connect should be installed on a dedicated domain-joined server, but you can also install it on your domain controller (Windows Server 2016 or later with Desktop Experience is required for Azure AD Connect V2) AD and AAD accounts for your Azure AD Connect server.
How do I know if my ad Sync is working? ›You can check the status in the Microsoft 365 admin center. If there are no errors present, the DirSync or Azure AD Connect Status icon appears as a green circle (successful).
What scripts can be used to force Azure AD Connect to run a full sync? ›To start a full sync, you can use the Start-AdSyncSyncCycle cmdlet. Use the PolicyType parameter to choose either Full or Delta depending on the sync you'd like to initiate. Either method will force an AD sync for Office 365, user identity accounts and all other attributes.
How do I force my Microsoft account to sync? ›
- In the Microsoft Edge app, select More options > Settings , and then select your profile image.
- Under Sync settings, select Sync. ...
- Select the toggles along the right side of the screen to turn sync on or off for each feature, then select Done.
The status Not delivering can appear for multiple reasons, whether the ad, ad set or ad campaign has been turned off or has finished its scheduled course of delivery. However, if there is an issue preventing the ad from being delivered, the sub-status will read Update required.
Should I run ads on a schedule? ›Yes, running ads at certain times can help you grow your audience and make more sales, but only if you go into it with a clear understanding of why you're promoting each thing, and where it fits in the bigger marketing picture.
How do I activate the ad scheduling feature? ›Open the Facebook ad set you want to set up dayparting on. Edit the ad set and go to the “Budget & Schedule” section. Click “Show more options” at the bottom of the section and check the box “Run ads on a schedule.” Create your ad schedule by marking the boxes on the schedule blue.
How long does it take to sync from Active Directory to Office 365? ›The service typically takes less than 30 minutes to provision a user or to sync changes for a user. It could take up to 24 hours for provisioning to occur or for changes to sync. If the issue persists after 24 hours, submit a support service request.
Does Office 365 sync automatically? ›...
Sync basics - what you can and cannot sync.
| Use | To |
|---|---|
| Schedules | Send all messages at a time that you set. |
The Azure Active Directory Connect synchronization services (Azure AD Connect sync) is a main component of Azure AD Connect. It takes care of all the operations that are related to synchronize identity data between your on-premises environment and Azure AD.
How do I stop Azure AD Connect cloud sync? ›To disable Azure AD Connect, install the MSOnline (Azure AD v1 PowerShell) module, and then run Set-MsolDirSyncEnabled -EnableDirSync $false. This will disable directory synchronization on your Azure AD tenant and will convert all synchronized objects (DirSyncEnabled = True) to cloud objects(DirsyncEnabled = False).
How do I kick off Azure AD Sync? ›- Use the Enter-PSSession command to connect to your Azure AD Connect server.
- Perform a delta synchronization using the Start-ADSyncSyncCycle command.
- Exit the PSSession to kill the connection to your Azure AD Connect server.
- On your Android device, open the Chrome app .
- On the right of the address bar, tap More. Settings.
- Tap your name.
- Tap Sign out and turn off sync.
How does Azure AD Connect sync work? ›
Simply put, organizations use Azure AD Connect to automatically synchronize identity data between their on-premises Active Directory environment and Azure AD. That way, users can use the same credentials to access both on-premises applications and cloud services such as Microsoft 365.
How do I stop disabled users from syncing with Azure AD Connect? ›- Click “Next” and in the Scoping filter dialog box select the Add Group button and then the Add Clause button. ...
- Click the Next button and skip the Join Rules dialog box. ...
- You should now click the Add button to create the new rule.
If you leave auto-sync on, you may find your Android device running low on battery power much quicker than you want. So it's best to turn it off unless you really need it. For more, see the original article at the link below.
Can you disable sync? ›Sync and Google services.
Under “Sync,” click Manage what you sync. Turn off Sync everything. Turn off any data that you don't want to sync to your account.
To find Sync settings, select Start , then select Settings > Accounts > Sync your settings .
What happens if I turn off sync settings? ›If you turn off sync, you can still see your bookmarks, history, passwords, and other settings on your computer. If you make any changes, they won't be saved to your Google Account and synced to your other devices. When you turn off sync, you'll also be signed out of other Google services, like Gmail.
What is the purpose of synchronizing? ›The main purpose of synchronization is the sharing of resources without interference using mutual exclusion. The other purpose is the coordination of the process interactions in an operating system. Semaphores and monitors are the most powerful and most commonly used mechanisms to solve synchronization problems.
What happens if I turn Auto sync off? ›Tip: Turning off auto-sync for an app doesn't remove the app. It only stops the app from automatically refreshing your data. Open your phone's Settings app.