Entra Connect Sync deadline: April 7, 2027, not Sept 30

If you run hybrid identity — Active Directory on-premises, accounts synchronized into the cloud — there is a hard date on your calendar whether you put it there or not. By April 7, 2027, every Microsoft Entra Connect Sync server needs to be on version 2.6.84.0 or later and configured for application-based authentication. Miss either half and, in Microsoft's words, "synchronization services will stop working." Not "loses support." Stops.

Microsoft's installation prerequisites page carries the notice under the heading "Mandatory upgrade required", and the same text sits at the top of the version history. It is explicit about recovery, too: "If synchronization stops, upgrade to the latest version and configure application-based authentication to restore service."

Two things changed at once on September 29, and the second is the bigger job. The minimum version rose from 2.5.79.0 to 2.6.84.0 — an upgrade. And the notice now requires application-based authentication, which Microsoft describes as replacing the Microsoft Entra Connector account's username and password with "an application identity that uses Oauth 2.0 client credential flow with certificate credentials." That is a change to how your most privileged sync server proves who it is, not a version bump.

Earlier updates to this post

The callouts below were written while the September 30 notice was still live. The version and end-of-support facts in them still hold; read any mention of September 30 as historical.

One more thing in 2.6.91.0 worth knowing: it adds a guided migration workflow from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync — configuration assessment, provisioning agent setup, staged activation, and validation, built into the release. It is available only in the Azure public cloud. That is a bigger decision than a version bump — worth evaluating on its own timeline, and now worth evaluating alongside the April 7, 2027 authentication change, since both touch the same server.

The version trap

Microsoft's Entra Connect Sync version history — last updated September 29, 2026 — publishes a retirement table. Read it next to the new 2.6.84.0 minimum and the trap is obvious:

Until September 29, the warning named 2.5.79.0 as the minimum. An admin who did the sensible thing — upgraded to the version named in the warning and closed the ticket — is now on a build that is below the new 2.6.84.0 minimum and whose published end of support is October 23, 2026. The change window they fought for bought a few weeks, and the next conversation is already due.

The same logic applies to the new floor. 2.6.84.0 meets the April 7, 2027 requirement on version, and its published end of support is September 16, 2027 — runway, but not much past the deadline. The newest build, 2.6.92.0, has no end-of-support date printed yet and carries Microsoft's "upgrading to this version as soon as possible" notice.

Neither fact is hidden. They simply live in different places: the deadline is a banner, and the per-version retirement dates are a table further down the version history. Planning this upgrade properly means reading both — that is the difference between booking one change window and booking two.

What stops if a server misses the requirement

"Synchronization stops" sounds abstract until you decompose it into the things your organization notices.

• Password hash synchronization stops. A user changes their password on-premises and the cloud never hears about it. Help desk volume follows within hours.
• New-hire provisioning stops. Accounts created in Active Directory do not appear in the cloud directory. Every onboarding stalls at the same step, and the workaround people reach for is manual cloud accounts that then have to be reconciled later.
• Deprovisioning stops. This is the one that should get security's attention. Disabling a departing employee's Active Directory account no longer removes their cloud access. Your offboarding runbook still says "disable in AD," the technician still does it, the checkbox still gets ticked — and the access is still live.

The failure mode is quiet. Directory synchronization does not surface an error to end users; it simply stops reflecting reality, and the gap between what Active Directory says and what the cloud believes widens every day until someone reconciles it by hand.

Why this is a Tier-0 change, not a lunchtime patch

The Entra Connect Sync server is not an application server that happens to run a Microsoft agent. It holds credentials that can write to your directory. Compromise it and you have compromised the identity plane — which is the working definition of a Tier-0 asset.

That classification changes the shape of the work. A Tier-0 change means a scheduled window, a documented rollback position, administration from an appropriately trusted workstation, and verification afterwards that synchronization actually resumed rather than merely that the installer exited cleanly. None of that is difficult. All of it takes calendar time — and the teams that miss April 7 will mostly miss it on approvals, not on engineering.

The authentication change raises the stakes on that discipline. Moving the connector from a password to a certificate-backed application identity means deciding who manages the certificate — Microsoft Entra Connect by default, or your own certificate or application — and where its private key lives. Microsoft's guidance recommends a TPM-backed key. Those are decisions to make deliberately, not in the last fortnight before a hard cutoff.

What to do before April 7, 2027

Short, ordered, and none of it requires a project:

1. Find every Entra Connect Sync server and record its exact version. Including the staging server if you have one — a staging server that falls behind is a rollback position that does not exist. Write the versions down; "we think it is current" is not an inventory.
2. Compare each version against the retirement table above. Below 2.6.84.0 means you do not meet the April 7, 2027 requirement. On 2.5.79.0 means an October 23, 2026 end-of-support date as well. Below 2.5.79.0 means you are already out of support — confirm synchronization is actually running today.
3. Pick a target build with runway, not the floor. The whole point of the trap is that the minimum is not a destination. Choose from the version history table with the end-of-support column visible, so the next upgrade is a year out rather than a month out.
4. Plan the authentication change, not just the upgrade. Pick the certificate-management option (managed by Microsoft Entra Connect, Bring Your Own Certificate, or Bring Your Own Application), check whether the server has a TPM, and read Microsoft's application identity guide before the window, not during it.
5. Book the change window well before April 7, 2027. Treat it as a Tier-0 change: approval, window, rollback position, named owner. A server on 2.5.79.0 should go first — its October 23, 2026 end of support comes long before the new deadline.
6. Verify synchronization after the change, not just the installer's exit. Confirm a test password change flows through, a test account provisions, and a test disable propagates. Those are the three things that break, so those are the three things to prove.
7. Put the next end-of-support date on the calendar before you close the ticket. Under a twelve-month retirement policy driven by Microsoft's release cadence, this is a recurring maintenance item, not a one-off.

Common mistakes we expect to see

Upgrading to the version named in the warning

Covered above, and worth repeating because it is the default behavior of a competent admin working from one page. The minimum is the pass mark, not the answer — and the minimum already moved once, from 2.5.79.0 to 2.6.84.0. Read the version history page before choosing a target build.

Assuming a deadline this hard comes with a grace period

Most Microsoft lifecycle dates end support: you stop receiving updates and keep running. This one is a back-end service change, and the documented outcome is that "synchronization services will stop working after this date if these requirements aren't met." There is nothing to buy. The date has already been rewritten once; do not plan on it happening again.

Treating an unchanged server as a current server

Because the twelve-month clock starts when the next version ships, a server nobody has touched can move from supported to retired without a single change on your side. "We have not changed anything" is a reason to check the version, not a reason to assume it is fine.

Related reading

• Why the sync server belongs in the protected tier, and the four controls that fit a mid-market shop: AD Tier-0 in 90 days: mid-market edition.
• The other reason a hybrid org still runs on-premises servers it forgets about: Exchange SE CU2 and the coexistence deadline.
• What your directory can and cannot do at its current functional level: AD functional levels: you are not as stuck as you think.
• Service detail: Entra ID hybrid identity.

Sources and further reading

• Microsoft Learn — Microsoft Entra Connect Sync installation prerequisites (carries the "Mandatory upgrade required" notice and the April 7, 2027 deadline)
• Microsoft Learn — Microsoft Entra Connect Sync version release history (publishes the per-version end-of-support table and the 12-month retirement policy)
• Microsoft Learn — Authenticate to Microsoft Entra ID by using application identity (the application-based authentication the April 7, 2027 notice requires)

Where to start

Get the version numbers now. Everything else in this post is a decision you cannot make until you know what you are running, and the inventory is a ten-minute job that most teams have been deferring since the notice went up. If every server is on 2.6.84.0 or later and already using application-based authentication, you are done until the next build retires. If not, book the change window well before April 7, 2027: a planned Tier-0 change is materially cheaper than an emergency one after sync stops.

If you would rather have a senior engineer confirm the version position, plan the upgrade as a Tier-0 change, and verify that password sync, provisioning, and deprovisioning all resumed afterwards, the project intake form takes about three minutes. We'll come back with scope and a fixed-fee range.

Pro IT NW does senior-led Microsoft project work. Vendor-neutral. Labor-only. Based in Seattle, delivered USA-wide. We don't take resale margins on licensing, and we don't sell you a managed service to fix a version number.