How to force a password sync in Microsoft Entra Connect (2026 guide)
Microsoft Entra Connect Sync (formerly Azure AD Connect) synchronises on-premises Active Directory users, groups and password hashes to Microsoft Entra ID. Password hash synchronisation runs on its own channel roughly every two minutes, so a password changed in Active Directory normally reaches Microsoft 365 within a few minutes. When it does not, or when you have just enabled password hash sync and need every user's hash pushed to the cloud, you can force the sync manually from PowerShell.
Quick answer: on the Entra Connect server, open PowerShell as an administrator and run Import-Module ADSync followed by Start-ADSyncSyncCycle -PolicyType Delta. That starts an immediate delta sync cycle. To resend the password hashes of every user, use the full password sync script further down.
This guide covers the cmdlets in the current Microsoft Entra Connect Sync (2.x) releases, how to read Get-ADSyncScheduler, how to verify that the sync actually ran, and the errors we see most often. It does not apply to Microsoft Entra Cloud Sync, which uses the provisioning agent and has no ADSync module.
When to force a password sync
- A user changed their password in on-premises Active Directory, but the old password still works, or the new one fails, in Microsoft 365.
- You have just enabled password hash synchronisation, or moved to a new Entra Connect server, and need all hashes pushed to Entra ID.
- The Application event log shows no password sync heartbeat (event 654) for hours.
- You reset the password of a locked-out user and cannot wait for the next scheduled cycle.
Step 1: Run a delta sync cycle
- Sign in to the Microsoft Entra Connect server.
- Open PowerShell as an administrator.
- Load the module and start a delta sync:
Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Delta
A delta cycle runs delta import, delta synchronisation and export on all connectors, and only processes changes since the last run. If you changed synchronisation rules or filtering and need every object re-evaluated, run a full cycle instead. A full cycle can take a long time in large directories:
Start-ADSyncSyncCycle -PolicyType Initial
Step 2: Check the scheduler with Get-ADSyncScheduler
Before you troubleshoot any further, look at the scheduler configuration:
Get-ADSyncScheduler
The properties that matter:
| Property | What it tells you |
|---|---|
SyncCycleEnabled | Must be True. If False, the scheduler is not running import, sync and export at all. |
StagingModeEnabled | Must be False on the active server. A staging server imports and syncs but never exports and never syncs passwords. |
NextSyncCyclePolicyType | Delta or Initial: the type of the next scheduled run. |
NextSyncCycleStartTimeInUTC | When the next scheduled cycle starts. The default interval is 30 minutes. |
CurrentlyEffectiveSyncCycleInterval | The sync interval actually in effect. |
To see whether a connector is running right now:
Get-ADSyncConnectorRunStatus
An empty result means the sync engine is idle. If a connector name is returned, a cycle is in progress and a new Start-ADSyncSyncCycle is rejected until it finishes.
Step 3 (optional): Force a full sync of all password hashes
A delta sync moves object and attribute changes. Password hashes travel on a separate channel, and when that channel is stuck the fix is to resend all hashes once. Microsoft documents the following script for that. Run it only once. If you need it a second time, something else is wrong and you should open a support case.
Replace the connector names with your own. They are case sensitive and are listed under Connectors in Synchronization Service Manager:
Import-Module ADSync
$adConnector = "contoso.local"
$aadConnector = "contoso.onmicrosoft.com - AAD"
$c = Get-ADSyncConnector -Name $adConnector
$p = New-Object Microsoft.IdentityManagement.PowerShell.ObjectModel.ConfigurationParameter "Microsoft.Synchronize.ForceFullPasswordSync", String, ConnectorGlobal, $null, $null, $null
$p.Value = 1
$c.GlobalParameters.Remove($p.Name)
$c.GlobalParameters.Add($p)
$c = Add-ADSyncConnector -Connector $c
Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $false
Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $true
The last two lines disable and re-enable the password sync channel, which triggers a full password hash sync for every user in that connector. Expect events 617 and 618 (full password hash sync started for the forest and domain) followed by 622 and 623 when it completes.
How to verify the sync ran
Confirm the sync engine is idle again. Get-ADSyncConnectorRunStatus returns nothing once the cycle has finished.
Check the Operations tab. Open Synchronization Service Manager on the server. The Operations view lists every step of the run (Delta Import, Delta Synchronization, Export) with a status and timestamp. Each step from your run should show success, and the Export step for the Entra ID connector should show the number of updated objects.
Read the Application event log. Filter on the source "Directory Synchronization". These are the password hash sync events worth knowing:
| Event ID | Meaning |
|---|---|
| 650 / 651 | Start and end of a password hash sync batch. |
| 656 / 657 | Password hash sync request and response. A 657 confirms that Entra ID received the batch. |
| 654 | Heartbeat. Logged every 30 minutes when the channel is healthy and idle. |
| 617 / 618 | Full password hash sync started for a forest / domain. |
| 622 / 623 | Full password hash sync completed for a domain / forest. |
Check the status in the Entra admin center. Under Identity, Hybrid management, Microsoft Entra Connect, the Connect Sync overview shows the last sync time and whether password hash sync is enabled and healthy.
Test the sign-in. Sign in with the user's new password in a private browser window. That is the only test the user cares about.
For a single user, the diagnostics module prints the result of the last password sync attempt for that object, including the reason if it was filtered:
Import-Module ADSyncDiagnostics
Invoke-ADSyncDiagnostics -PasswordSync -ADConnectorName "contoso.local" -DistinguishedName "CN=Jane Doe,OU=Users,DC=contoso,DC=local"
Common errors
"The sync command or cmdlet isn't available". The ADSync module is not loaded, which happens on servers with stricter PowerShell execution policies or when Entra Connect runs on a domain controller. Run Import-Module ADSync first.
SyncCycleEnabled is False. Someone disabled the scheduler, usually while editing sync rules or filtering, and forgot to enable it again. Re-enable it with:
Set-ADSyncScheduler -SyncCycleEnabled $true
StagingModeEnabled is True. A server in staging mode never exports and never synchronises passwords, so forcing a sync there changes nothing in the cloud. Run the sync on your active server, or take this server out of staging mode through the Entra Connect wizard (Configure staging mode). Never run two servers in active mode against the same tenant.
Start-ADSyncSyncCycle is rejected because a cycle is already running. Check with Get-ADSyncConnectorRunStatus and wait for it to finish, or stop the current cycle with Stop-ADSyncSyncCycle and start again. Stopping a cycle is harmless. Pending changes are picked up by the next run.
One user's password never syncs, everyone else is fine. Check whether "User must change password at next logon" is set in Active Directory. Temporary passwords are skipped (status FilteredByTarget in the object's password sync log) unless you run Entra Connect 2.0.3.0 or later with the ForcePasswordChangeOnLogon feature enabled. Also confirm the user is not excluded by your OU or attribute filtering.
Events 611, 652 or 655 in the Application log. These point to a connectivity or permissions problem with a domain. Verify that the AD DS connector account has "Replicate Directory Changes" and "Replicate Directory Changes All" at the root of every domain, and that the server can reach a domain controller in that domain. Restart the Microsoft Entra ID Sync (ADSync) service after fixing permissions.
No heartbeat (event 654) for more than three hours. The password sync channel is stuck. Run the full password sync script above once and look for the 617 and 618 events. Invoke-ADSyncDiagnostics -PasswordSync runs the same checks automatically and tells you which one fails.
Related reading
- What is Microsoft Entra ID? and Active Directory in our IT glossary.
- Multi-factor authentication (MFA) and Single Sign-On, the two features that make hybrid identity worth the effort.
- Our Microsoft 365 and Microsoft Azure services.
- Microsoft Learn: Entra Connect Sync scheduler and troubleshoot password hash synchronization.
Need a hand with hybrid identity?
Our 24/7 service desk runs Entra Connect, Conditional Access and MFA for businesses that keep an on-premises Active Directory next to Microsoft 365. Contact us if your sync is stuck and you would rather not spend the afternoon in Synchronization Service Manager.