ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 257/260 feeds/APIs · 416/439 docs · checked 21:54 UTC Customize Public modeDiscuss ChangeIntel on Discord

Entra Connect version history

This page's changes and edits · All guidance changes

Microsoft's edit ·

Spelling fixes (#2125)

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 12cb62a · +34 −34 lines · also on GitHub

⋯ 49 unchanged lines
5050 1. Open `miiserver.exe.config` and add the following entry inside the assemblyBinding section:
5151 `<dependentAssembly>
5252 <assemblyIdentity name="System.Diagnostics.DiagnosticSource" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
53 − <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0" />
53 + <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0" />
5454 </dependentAssembly>`
5555
5656 1. Save the file.
⋯ 27 unchanged lines
8484 > [!IMPORTANT]
8585 > Versions of Microsoft Entra Connect Sync 2.x retire 12 months from the date that a newer version is released.
8686 > This policy went into effect on 15 March 2023.
87 −>
87 +>
8888 > For new installs, always install the latest version. For upgrades, make sure you upgrade to the latest version before the retirement of your current version.
8989
9090 |Version |End of support date |Release date |
⋯ 45 unchanged lines
136136
137137 ### Release status
138138
139 −09/23/2026: Released for download via the Microsoft Entra admin center. This is a hotfix release.
139 +09/23/2026: Released for download via the Microsoft Entra admin center. This is a hotfix release.
140140
141141 ### Bug fixes
142142
⋯ 15 unchanged lines
158158
159159 ### Updated features
160160
161 −- Phishing-resistant authentication in the Microsoft Entra Connect setup wizard is now generally available and enabled by default. The Windows Web Account Manager prompt supports passkeys, FIDO2 security keys, and passwords, reuses the signed-in session across Microsoft Entra services, and preserves Seamless Single Sign-On Kerberos key rotation.
161 +- Phishing-resistant authentication in the Microsoft Entra Connect setup wizard is now generally available and enabled by default. The Windows Web Account Manager prompt supports passkeys, FIDO2 security keys, and passwords, reuses the signed-in session across Microsoft Entra services, and preserves Seamless Single Sign-On Kerberos key rotation.
162162 - When you configure Seamless Single Sign-On by using the standalone PowerShell module, you must import `ADSync.psd1` before `AzureADSSO.psd1`. [Learn more](../cloud-sync/how-to-sso.md).
163163 - Cloud configuration cmdlets no longer require an explicit `-AADUserName`. When you omit the parameter, Microsoft Entra Connect derives a sign-in hint from the connector configuration and opens an interactive sign-in prompt. This behavior applies to `Set-ADSyncAADCompanyFeature`, `Set-ADSyncAADPasswordSyncState`, `Enable-ADSyncExportDeletionThreshold`, `Set-ADSyncScheduler`, and `Set-ADSyncDirSyncConfiguration`.
164164 - The Select Containers dialog in Synchronization Service Manager is now read-only. You can still use the dialog to view the current selections. To make changes, use Customize synchronization options in the Microsoft Entra Connect wizard. [Learn more](how-to-connect-installation-wizard.md#customize-synchronization-options).
⋯ 26 unchanged lines
191191
192192 ### Added features
193193
194 −- Added support for phishing-resistant authentication methods in the Microsoft Entra Connect setup wizard (preview). Administrators can now sign in using passkeys and FIDO2 security keys through Windows Web Account Manager (WAM) when configuring Microsoft Entra Connect.
194 +- Added support for phishing-resistant authentication methods in the Microsoft Entra Connect setup wizard (preview). Administrators can now sign in using passkeys and FIDO2 security keys through Windows Web Account Manager (WAM) when configuring Microsoft Entra Connect.
195195 - Added support for the France sovereign cloud environment, including Pass-through Authentication, Seamless Single Sign-On, password writeback, and Health Agent monitoring.
196196
197197 ### Updated features
⋯ 90 unchanged lines
288288
289289 ### Release status
290290
291 −09/01/2025: Released for download via the Microsoft Entra admin center. Existing installations will be auto-upgraded to this build starting September 4, 2025 and will be done in multiple phases.
291 +09/01/2025: Released for download via the Microsoft Entra admin center. Existing installations will be auto-upgraded to this build starting September 4, 2025 and will be done in multiple phases.
292292
293293
294 −### Added Features
294 +### Added Features
295295
296 −- Improved the setup process for Application-Based Authentication to handle TPM-backed certificates (certificates protected by a Trusted Platform Module, see [What is a TPM?](/windows/security/information-protection/tpm/trusted-platform-module-overview)). The system now tests a certificate’s signing capability upfront and automatically falls back to software-based certificates if TPM signature fails.
297 −- Implemented automatic removal of certificates if an Application-Based Authentication configuration fails after a certificate is created. This prevents unused certificates from lingering on the server in failure scenarios, improving security by avoiding accumulation of orphaned certificates.
296 +- Improved the setup process for Application-Based Authentication to handle TPM-backed certificates (certificates protected by a Trusted Platform Module, see [What is a TPM?](/windows/security/information-protection/tpm/trusted-platform-module-overview)). The system now tests a certificate’s signing capability upfront and automatically falls back to software-based certificates if TPM signature fails.
297 +- Implemented automatic removal of certificates if an Application-Based Authentication configuration fails after a certificate is created. This prevents unused certificates from lingering on the server in failure scenarios, improving security by avoiding accumulation of orphaned certificates.
298298
299299 ### Bug fixes
300300
301 −- Resolved an issue on FIPS-enabled servers that was causing setup failures. Application-Based Authentication now works correctly on servers with FIPS mode enabled by using FIPS-compliant cryptographic algorithms.
301 +- Resolved an issue on FIPS-enabled servers that was causing setup failures. Application-Based Authentication now works correctly on servers with FIPS mode enabled by using FIPS-compliant cryptographic algorithms.
302302 > [!TIP]
303303 > FIPS (Federal Information Processing Standards) mode is a Windows security setting that enforces the use of cryptographic algorithms for sensitive data. When FIPS mode is enabled, only FIPS-compliant algorithms can be used, which is why this fix ensures compatibility for environments requiring strict security standards.
304 −- Fixed an issue where certificate auto-rotation was incorrectly reported as active when the scheduler was suspended. The auto-rotation logic now checks the scheduler’s state before indicating status, ensuring the *View or export current configuration wizard* accurately reflects whether auto-rotation is enabled.
305 −- Removed an inappropriate admin audit event that was being logged for automatic certificate operations. These background certificate actions no longer generate administrative audit log entries, resulting in a cleaner audit trail (only actual administrator-initiated changes will appear in the Entra Connect Sync audit logs).
304 +- Fixed an issue where certificate auto-rotation was incorrectly reported as active when the scheduler was suspended. The auto-rotation logic now checks the scheduler’s state before indicating status, ensuring the *View or export current configuration wizard* accurately reflects whether auto-rotation is enabled.
305 +- Removed an inappropriate admin audit event that was being logged for automatic certificate operations. These background certificate actions no longer generate administrative audit log entries, resulting in a cleaner audit trail (only actual administrator-initiated changes will appear in the Entra Connect Sync audit logs).
306306
307307 ## 2.5.76.0
308308
⋯ 2 unchanged lines
311311
312312 ### Release status
313313
314 −07/31/2025: Released for download via the Microsoft Entra admin center. Existing installations will be auto-upgraded to this build starting August 14th, 2025, and will be done in multiple phases.
314 +07/31/2025: Released for download via the Microsoft Entra admin center. Existing installations will be auto-upgraded to this build starting August 14th, 2025, and will be done in multiple phases.
315315
316316
317 −### Added Features
317 +### Added Features
318318
319 −- Application based authentication to Microsoft Entra ID is now generally available and will be the default option. See [Authenticate to Microsoft Entra ID by Using Application Identity](authenticate-application-id.md).
320 −- Administrator action logging is now generally available, providing Windows audit events for all administrative changes made on Microsoft Entra Connect. See [Auditing administrator events in Microsoft Entra Connect Sync](admin-audit-logging.md).
321 −- Group Source of Authority conversion feature allowing administrators to transfer on-premises Active Directory groups to become cloud only groups managed through Microsoft Entra ID (Public Preview). See [Group Source of Authority overview](../concept-source-of-authority-overview.md).
319 +- Application based authentication to Microsoft Entra ID is now generally available and will be the default option. See [Authenticate to Microsoft Entra ID by Using Application Identity](authenticate-application-id.md).
320 +- Administrator action logging is now generally available, providing Windows audit events for all administrative changes made on Microsoft Entra Connect. See [Auditing administrator events in Microsoft Entra Connect Sync](admin-audit-logging.md).
321 +- Group Source of Authority conversion feature allowing administrators to transfer on-premises Active Directory groups to become cloud only groups managed through Microsoft Entra ID (Public Preview). See [Group Source of Authority overview](../concept-source-of-authority-overview.md).
322322
323323 ### Bug fixes
324324
325 −- The issue in selecting and de-selecting child OUs, affecting Active Directory multi-domain scenarios in the Connect Sync wizard, is fixed.
326 −- The issue where users were prompted to set up Azure MFA instead of on-premises ADFS MFA, due to federated domain settings and MFA flag resets during updates, has been resolved.
325 +- The issue in selecting and de-selecting child OUs, affecting Active Directory multi-domain scenarios in the Connect Sync wizard, is fixed.
326 +- The issue where users were prompted to set up Azure MFA instead of on-premises ADFS MFA, due to federated domain settings and MFA flag resets during updates, has been resolved.
327327 - Resolved an issue that prevented some Microsoft Entra Connect Sync instances from auto-upgrading by ensuring the agent identifier is correctly sourced when missing.
328328 - Fixed issue in the configuration wizard that resulted in **Directory synchronization for this directory currently has a mismatch in sync enabled and sync status** error when DirSync Status is in **PendingEnabled**
329329
⋯ 40 unchanged lines
370370
371371 ### Bug fixes
372372 - Fixed the removal of the SSPR configuration when changes are made on the Azure AD Connector and saved in the Sync Service manager UI
373 −- Fixed validation for the Global Administrator/Hybrid Identity Administrator role done during Entra Connect Sync installation and users with Global Administrator/Hybrid Identity Administrator through Privileged Identity Management (PIM).
373 +- Fixed validation for the Global Administrator/Hybrid Identity Administrator role done during Entra Connect Sync installation and users with Global Administrator/Hybrid Identity Administrator through Privileged Identity Management (PIM).
374374 - Fixed the "no registered protocol handlers" error on Federate with AD FS scenario.
375375 - Fixed "Relying party must be unique (conflict error)" error on Federate with AD FS scenario.
376376
⋯ 10 unchanged lines
387387
388388 ### Bug fixes
389389 - Fixed an issue with Privileged Identity Management (PIM), Microsoft Entra roles, and PIM for Groups to verify that PIM is enabled and that the user has the Hybrid Identity Administrator role enabled.
390 −- Fixed an issue where AD FS commands were failing when Connect Sync is installed on a non-ADFS server.
390 +- Fixed an issue where AD FS commands were failing when Connect Sync is installed on a non-ADFS server.
391391
392392
393393
⋯ 20 unchanged lines
414414 ### Updated Features
415415 - The step **Connect to Microsoft Entra ID** in the Connect Sync Wizard won't require password before redirecting you to the login page.
416416 - Updated Default Rule: "onPremisesObjectIdentifier" attribute added to the **In from AD - User Account Enabled** sync rule. Adding this rule allows the sync engine to pick the **onPremisesObjectIdentifier** attribute from the user who is enabled, in a scenario where:
417 − - the same user is represented across different forests, and
417 + - the same user is represented across different forests, and
418418 - the user is disabled in one of the forests
419 −- Introduced a registry key that allows you to set the precedence number for custom rules to be more than 100, if needed. The precedence of the first standard rule can be set using the key **HLKM:\SOFTWARE\Microsoft\Azure AD Connect\FirstStandardRulePrecedence,** allowing for more custom rules. If no value is set, 100 is the default.
419 +- Introduced a registry key that allows you to set the precedence number for custom rules to be more than 100, if needed. The precedence of the first standard rule can be set using the key **HKLM:\SOFTWARE\Microsoft\Azure AD Connect\FirstStandardRulePrecedence,** allowing for more custom rules. If no value is set, 100 is the default.
420420 - Cmdlets in ADSync PowerShell module that communicate with Microsoft Entra ID now require Microsoft Entra ID login, for example, `Add-ADSyncAADServiceAccount` or `Get-ADSyncExportDeletionThreshold`
421421
422422
⋯ 3 unchanged lines
426426 - All references to legacy MSOnline PowerShell module have been removed and replaced by equivalent Microsoft Graph API calls.
427427
428428
429 −### Miscellaneous
429 +### Miscellaneous
430430 - The minimum .NET runtime requirement has been increased to 4.7.2.
431431 - Branding updates to match Microsoft Entra ID branding.
432432
⋯ 2 unchanged lines
435435
436436 - Improved Wizard experience to ensure domain validation has to be completed before moving to the next step in the wizard.
437437 - Improved error messaging when fetching list of domains in a forest
438 −- Fixed error that made installing with an existing database incompatible with Password Writeback enabled.
438 +- Fixed error that made installing with an existing database incompatible with Password Writeback enabled.
439439 - Fixed credential issue with ADConnectivityTool module that could occur if NTLM is set to deny-all.
440440 - Fixed error around localization string that could occur when prompting for Enterprise Admin.
441441 - Fixed an issue where the re-running the Wizard would display initial OU configuration instead of the correct configuration.
⋯ 2 unchanged lines
444444 - Fixed an issue where auto upgrade could fail when trying to get the service account.
445445 - Fixed an error that could occur if a join rule contains an attribute name with a hyphen.
446446 - Improved error messaging in the Wizard when TLS settings don't meet the prerequisites.
447 −- Fixed a bug with the password hash not syncing on changing the SMART CARD REQUIRED bit flag. This fix won't allow the passwords in Microsoft Entra ID and Active Directory to be in sync for scenarios where smart card is used as an authentication method. [Learn more](how-to-connect-password-hash-synchronization.md#password-hash-synchronization-and-smart-card-authentication)
447 +- Fixed a bug with the password hash not syncing on changing the SMART CARD REQUIRED bit flag. This fix won't allow the passwords in Microsoft Entra ID and Active Directory to be in sync for scenarios where smart card is used as an authentication method. [Learn more](how-to-connect-password-hash-synchronization.md#password-hash-synchronization-and-smart-card-authentication)
448448 - Fixed a bug where auto upgrade endpoints were configured incorrectly for some clouds.
449449
450450
⋯ 1 unchanged line
452452
453453 >[!IMPORTANT]
454454 >Version 2.3.20.0 is a security update. With this update, Microsoft Entra Connect requires TLS 1.2. Ensure that you have TLS 1.2 enabled before updating to this version.
455 −>
455 +>
456456 >All versions of [Windows Server support TLS 1.2](/windows-server/security/tls/tls-ssl-schannel-ssp-overview). If TLS 1.2 isn't enabled on your server you'll need to enable this before you can deploy Microsoft Entra Connect V2.0.
457457 >
458458 >For a PowerShell script to check whether TLS 1.2 is enabled, see [PowerShell script to check TLS](reference-connect-tls-enforcement.md#powershell-script-to-check-tls-12)
⋯ 86 unchanged lines
545545
546546 ## 2.1.20.0
547547
548 −### Release status:
548 +### Release status:
549549 11/9/2022: Released for download
550550
551551 ### Bug fixes
⋯ 2 unchanged lines
554554
555555 ## 2.1.19.0
556556
557 −### Release status:
557 +### Release status:
558558 11/2/2022: Released for download
559559
560560 ### Functional changes
⋯ 6 unchanged lines
567567
568568 ## 2.1.18.0
569569
570 −### Release status:
570 +### Release status:
571571 10/5/2022: Released for download
572572
573573 ### Bug fixes
574574 - we fixed a bug where upgrade from version 1.6 to version 2.1 got stuck in a loop due to IsMemberOfLocalGroup enumeration.
575 − - we fixed a bug where the Microsoft Entra Connect Configuration Wizard was sending incorrect credentials (username format) while validating if Enterprise Admin.
575 + - we fixed a bug where the Microsoft Entra Connect Configuration Wizard was sending incorrect credentials (username format) while validating if Enterprise Admin.
576576
577577 ## 2.1.16.0
578578
⋯ 8 unchanged lines
587587 ### Release status
588588 7/6/2022: Released for download.
589589
590 −> [!IMPORTANT]
590 +> [!IMPORTANT]
591591 > We have discovered a security vulnerability in the Microsoft Entra Connect Admin Agent. If you have installed the Admin Agent previously it's important that you update your Microsoft Entra Connect server(s) to this version to mitigate the vulnerability.
592592
593593 ### Functional changes
⋯ 16 unchanged lines
610610 - We made the following Accessibility fixes:
611611 - Fixed a bug where Focus is lost during keyboard navigation on Domain and OU Filtering page.
612612 - We updated the accessible name of Clear Runs drop down.
613 − - We fixed a bug where the tooltip of the "Help" button isn't accessible through keyboard if navigated with arrow keys.
613 + - We fixed a bug where the tooltip of the "Help" button isn't accessible through keyboard if navigated with arrow keys.
614614 - We fixed a bug where the underline of hyperlinks was missing on the Welcome page of the wizard.
615615 - We fixed a bug in Sync Service Manager's About dialog where the Screen reader isn't announcing the information about the data appearing under the "About" dialog box.
616616 - We fixed a bug where the Management Agent Name wasn't mentioned in logs when an error occurred while validating MA Name.
⋯ 17 unchanged lines
634634
635635 ### Functional changes
636636
637 −- We updated the Microsoft Entra Connect Health component in this release from version 3.1.110.0 to version 3.2.1823.12. This new version provides compliance of the Microsoft Entra Connect Health component with the [Federal Information Processing Standards (FIPS)](https://www.nist.gov/standardsgov/compliance-faqs-federal-information-processing-standards-fips) requirements.
637 +- We updated the Microsoft Entra Connect Health component in this release from version 3.1.110.0 to version 3.2.1823.12. This new version provides compliance of the Microsoft Entra Connect Health component with the [Federal Information Processing Standards (FIPS)](https://www.nist.gov/standardsgov/compliance-faqs-federal-information-processing-standards-fips) requirements.
638638
639639 ## 2.0.89.0
640640
⋯ 414 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:50 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 21:54 UTC · 257 of 260 readable · 255 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.