Entra Connect sync stops Sept 30: the version trap

If you run hybrid identity — Active Directory on-premises, accounts synchronized into the cloud — there is a hard date on your calendar whether you put it there or not. On September 30, 2026, Microsoft Entra Connect Sync stops synchronizing on any server below version 2.5.79.0. Not "loses support." Stops.

Microsoft's installation prerequisites page carries the notice under a heading that reads "Mandatory Upgrade Required": "All synchronization services in Microsoft Entra Connect Sync will stop working on September 30, 2026 if you're not on at least version 2.5.79.0. In May 2025, we released this version with a back-end service change that hardens our services. Upgrade before this deadline to avoid any service disruption." The same page is explicit about what happens if you miss it: "If you're unable to upgrade before the deadline, all synchronization services will fail until you upgrade to the latest version."

That much you can get from the documentation. Here is the part that is not on the prerequisites page, and it is the reason this post exists.

The version trap

Microsoft's Entra Connect Sync version history — last updated July 7, 2026 — publishes a retirement table. Read it next to the September 30 deadline and the trap is obvious:

An admin reading only the prerequisites page does the sensible thing: finds the minimum version named in the warning, upgrades to it, closes the ticket. That admin is now on a build whose published end of support is October 23, 2026 — roughly three weeks after the deadline they just cleared. The change window they fought for, the approvals, the after-hours verification: all of it bought less than a month, and the next conversation starts immediately.

Note the row above it, too. If you are sitting on 2.5.76.0, you are out of support on September 1, 2026 and non-functional on September 30, 2026 — two distinct events four weeks apart, and only the second one is described anywhere as a deadline.

Neither of these facts is hidden. They simply live on different pages: the September 30 cutoff is a prerequisites-page notice, and the per-version retirement dates are a version-history table. An admin who opens the page the warning pointed at gets the deadline and not the trap. Planning this upgrade properly means having both pages open at once — that is the whole difference between booking one change window and booking two.

What actually stops on September 30

"Synchronization stops" sounds abstract until you decompose it into the things your organization notices.

• Password hash synchronization stops. A user changes their password on-premises and the cloud never hears about it. Help desk volume follows within hours.
• New-hire provisioning stops. Accounts created in Active Directory do not appear in the cloud directory. Every onboarding stalls at the same step, and the workaround people reach for is manual cloud accounts that then have to be reconciled later.
• Deprovisioning stops. This is the one that should get security's attention. Disabling a departing employee's Active Directory account no longer removes their cloud access. Your offboarding runbook still says "disable in AD," the technician still does it, the checkbox still gets ticked — and the access is still live.

The failure mode is quiet. Directory synchronization does not surface an error to end users; it simply stops reflecting reality, and the gap between what Active Directory says and what the cloud believes widens every day until someone reconciles it by hand.

Why this is a Tier-0 change, not a lunchtime patch

The Entra Connect Sync server is not an application server that happens to run a Microsoft agent. It holds credentials that can write to your directory. Compromise it and you have compromised the identity plane — which is the working definition of a Tier-0 asset.

That classification changes the shape of the work. A Tier-0 change means a scheduled window, a documented rollback position, administration from an appropriately trusted workstation, and verification afterwards that synchronization actually resumed rather than merely that the installer exited cleanly. None of that is difficult. All of it takes calendar time — and the teams that miss September 30 will mostly miss it on approvals, not on engineering.

This is also the reason "we will do it in September" is a worse plan than it sounds. September 30 is a Wednesday at the end of a quarter, on a server most mid-market shops touch once a year and staff with one or two people who know it well. Compressing a Tier-0 change into the last fortnight before a hard cutoff removes exactly the margin you would want if the upgrade goes sideways.

What to do this week

Short, ordered, and none of it requires a project:

1. Find every Entra Connect Sync server and record its exact version. Including the staging server if you have one — a staging server that falls behind is a rollback position that does not exist. Write the versions down; "we think it is current" is not an inventory.
2. Compare each version against the retirement table above. Below 2.5.79.0 means you have a hard September 30 outage. On 2.5.76.0 means an end-of-support date of September 1 as well. On 2.5.79.0 means you have cleared the cutoff and inherited an October 23 end-of-support date.
3. Pick a target build with runway, not the floor. The whole point of the trap is that the minimum is not a destination. Choose from the version history table with the end-of-support column visible, so the next upgrade is a year out rather than a month out.
4. Book the change window now, for August or early September. Treat it as a Tier-0 change: approval, window, rollback position, named owner. Booking it now is what keeps the last two weeks of September free.
5. Verify synchronization after the change, not just the installer's exit. Confirm a test password change flows through, a test account provisions, and a test disable propagates. Those are the three things that break, so those are the three things to prove.
6. Put the next end-of-support date on the calendar before you close the ticket. Under a twelve-month retirement policy driven by Microsoft's release cadence, this is a recurring maintenance item, not a one-off.

Common mistakes we expect to see

Upgrading to the version named in the warning

Covered above, and worth repeating because it is the default behaviour of a competent admin working from one page. 2.5.79.0 is the pass mark, not the answer. Read the version history page before choosing a target build.

Assuming a deadline this hard comes with a grace period

Most Microsoft lifecycle dates end support: you stop receiving updates and keep running. This one is a back-end service change, and the documented outcome is that "all synchronization services will fail until you upgrade to the latest version." There is nothing to buy and nothing to extend.

Treating an unchanged server as a current server

Because the twelve-month clock starts when the next version ships, a server nobody has touched can move from supported to retired without a single change on your side. "We have not changed anything" is a reason to check the version, not a reason to assume it is fine.

Related reading

• Why the sync server belongs in the protected tier, and the four controls that fit a mid-market shop: AD Tier-0 in 90 days: mid-market edition.
• The other reason a hybrid org still runs on-premises servers it forgets about: Exchange SE CU2 and the coexistence deadline.
• What your directory can and cannot do at its current functional level: AD functional levels: you are not as stuck as you think.
• Service detail: Entra ID hybrid identity.

Sources and further reading

• Microsoft Learn — Microsoft Entra Connect Sync installation prerequisites (carries the "Mandatory Upgrade Required" notice and the September 30, 2026 deadline)
• Microsoft Learn — Microsoft Entra Connect Sync version release history (publishes the per-version end-of-support table and the 12-month retirement policy)

Where to start

Get the version numbers this week. Everything else in this post is a decision you cannot make until you know what you are running, and the inventory is a ten-minute job that most teams have been deferring since the notice went up. If every server is already above the floor with real runway on it, you are done. If not, the change window you book in August is materially cheaper than the one you book on September 25.

If you would rather have a senior engineer confirm the version position, plan the upgrade as a Tier-0 change, and verify that password sync, provisioning, and deprovisioning all resumed afterwards, the project intake form takes about three minutes. Two-business-day response with scope and a fixed-fee range.

Pro IT NW does senior-led Microsoft project work. Vendor-neutral. Labor-only. Based in Seattle, delivered USA-wide. We don't take resale margins on licensing, and we don't sell you a managed service to fix a version number.