PowerShell Script to Perform a Complete Microsoft Entra ID Connect Health Check

Microsoft Entra ID Connect (formerly Azure AD Connect) is a critical component of any hybrid Microsoft 365 environment. When synchronization issues occur, users can experience login failures, password synchronization delays, and missing objects in Microsoft 365.

To help identify issues before they impact users, this PowerShell script performs a comprehensive health check of your Entra ID Connect server, including synchronization status, connector health, scheduler configuration, password hash synchronization status, and recent synchronization errors.

Why Run an Entra ID Connect Health Check?

Regular health checks allow administrators to:

• Verify directory synchronization is operating correctly
• Confirm the synchronization scheduler is running
• Detect connector failures
• Identify export and synchronization errors
• Verify password hash synchronization functionality
• Check if staging mode has been enabled
• Troubleshoot hybrid identity issues proactively

Prerequisites

Before running the health check, ensure:

• You are logged on to the Entra ID Connect server
• PowerShell is running as Administrator
• The ADSync module is installed
• The Microsoft Entra Connect Sync service is running

Complete Entra ID Connect Health Check Script

Paste the following script into PowerShell:

# Run on the Entra Connect / Azure AD Connect server

Write-Host "======================================="
Write-Host "Microsoft Entra ID Connect Health Check"
Write-Host "======================================="
Write-Host ""

# Import ADSync module
Import-Module ADSync -ErrorAction SilentlyContinue

# Scheduler Information
$scheduler = Get-ADSyncScheduler

Write-Host "----- Sync Scheduler -----"
Write-Host "Sync Enabled :" $scheduler.SyncCycleEnabled
Write-Host "Scheduler Suspended :" $scheduler.SchedulerSuspended
Write-Host "Staging Mode :" $scheduler.StagingModeEnabled
Write-Host "Next Sync Cycle :" $scheduler.NextSyncCycleStartTimeInUTC
Write-Host "Last Sync Policy :" $scheduler.LastRunStatus
Write-Host ""

# Sync Cycle History
Write-Host "----- Recent Sync Runs -----"

Get-ADSyncRunProfileResult |
Sort-Object StartDate -Descending |
Select-Object -First 20 `
    ConnectorName,
    RunProfileName,
    StartDate,
    EndDate,
    Result |
Format-Table -AutoSize

Understanding the Results

Scheduler Status

The scheduler section confirms whether synchronization is enabled and whether future synchronization cycles are scheduled.

Example output:

Sync Enabled : True
Scheduler Suspended : False
Staging Mode : False
Next Sync Cycle : 29/08/2026 15:30

Ideally:

• Sync Enabled should be True
• Scheduler Suspended should be False
• Staging Mode should only be enabled on standby servers

Connector Status

The connector section displays all management agents configured in Entra Connect.

A typical environment will contain connectors for:

• On-premises Active Directory
• Microsoft Entra ID

Verify that all expected connectors exist and show a healthy connection state.

Recent Synchronization Runs

The script also shows the most recent synchronization cycles. Look for results showing:

success

Common issues include:

failed
stopped-server
permission-error
connection-error

Any recurring failures should be investigated immediately.

Password Hash Synchronization

If Password Hash Synchronization is being used for authentication, verify that password hashes continue to synchronize successfully.

Potential symptoms of issues include:

• Password changes not reaching Microsoft 365
• Users unable to sign in with updated passwords
• Password synchronization delays

Checking Entra Connect Health Services

If Microsoft Entra Connect Health has been installed, verify that the health monitoring services are running:

Get-Service *AzureADHealth*

Example output:

Name                      Status
----                      ------
AzureADHealthSyncMonitor  Running
AzureADHealthInsight      Running

Both services should normally be running.

Quick Daily Health Check

If you only need a summary view of the synchronization engine, run:

Get-ADSyncScheduler |
Select SyncCycleEnabled,
    StagingModeEnabled,
    SchedulerSuspended,
    NextSyncCycleStartTimeInUTC,
    LastRunStatus

This provides the most important synchronization information in a single command.

Generating an HTML Report

You can also generate an HTML report for scheduled monitoring and auditing purposes:

$scheduler = Get-ADSyncScheduler

$report = @()

$report += [PSCustomObject]@{
    SyncEnabled = $scheduler.SyncCycleEnabled
    StagingMode = $scheduler.StagingModeEnabled
    NextSync    = $scheduler.NextSyncCycleStartTimeInUTC
}

$report |
ConvertTo-Html -Title "Entra Connect Health Report" |
Out-File "C:\Reports\EntraConnectHealth.html"

This report can be generated automatically using Windows Task Scheduler and emailed to administrators as part of routine monitoring.

Conclusion

Microsoft Entra ID Connect remains one of the most important components in a hybrid identity deployment. Regular health checks help administrators identify synchronization failures, connector issues, export errors, and password synchronization problems before they impact users.

By incorporating this PowerShell health check into your operational processes, you can increase reliability, reduce troubleshooting time, and improve the overall health of your Microsoft 365 environment.