Delta Sync Issues

Delta synchronization in Entra ID Connect relies on incremental updates to reduce bandwidth and processing overhead. Issues such as incomplete syncs, missing changes, or inconsistent data can arise from misconfigurations, connectivity problems, or data inconsistencies. This section outlines steps to diagnose and resolve common delta sync problems.

Verify Sync Logs for Errors¶

Start by inspecting sync logs to identify specific failure points. Use the Get-EntraSyncLog cmdlet to retrieve detailed records of sync operations.

Get-EntraSyncLog -SyncDirection Delta -MaxResults 50 | Format-List

Look for entries with Status values like Failed, Error, or PartialSuccess. Filter by OperationType (e.g., UserUpdate, GroupDeletion) to isolate problematic actions.

Example:
If a user update fails due to a missing attribute, the log might show:

Error: "Attribute 'extensionAttribute1' is not recognized in the target directory."

Validate Delta Sync Configuration¶

Ensure delta sync is enabled and configured correctly in the Entra ID Connect portal. Navigate to Sync Settings > Delta Sync and confirm:
- Delta Sync Enabled: Set to Yes.
- Sync Frequency: Matches your organizational requirements (e.g., hourly).
- Delta Sync Scope: Includes all required objects (users, groups, etc.).

Example:
If delta sync is disabled, enable it via the portal and restart the sync engine:

Set-EntraSyncConfiguration -DeltaSyncEnabled $true
Restart-EntraSync

Check Network and Firewall Rules¶

Delta sync requires stable connectivity between Entra ID Connect and Azure AD. Verify:
1. DNS Resolution: Ensure the sync server can resolve Azure AD endpoints.

Test-NetConnection -ComputerName login.microsoftonline.com -Port 443

2. Firewall Rules: Confirm ports 443 (HTTPS) and 80 (HTTP for fallback) are open.
3. Proxy Settings: If using a proxy, validate it in the sync configuration.

Example:
If connectivity fails, temporarily disable the firewall to test:

netsh advfirewall set allprofiles state disable

Validate Data Consistency¶

Delta sync depends on accurate source data. Use PowerShell to compare source and target attributes:

# Fetch user data from source (e.g., on-premises AD)
Get-ADUser -Filter * -Properties * | Select-Object SamAccountName, EmailAddress

# Fetch corresponding users in Azure AD
Get-AzureADUser -All $true | Select-Object UserPrincipalName, Mail

Look for mismatches in attributes like Mail, DisplayName, or custom fields. Correct discrepancies in the source system before re-syncing.

Handle Sync Errors and Retries¶

If a sync operation fails, retry it manually or adjust retry policies:

# Retry a failed delta sync batch
Invoke-EntraSyncDeltaSync -BatchId "12345"

For persistent errors, review the Sync Error Log in the portal and address root causes (e.g., invalid passwords, expired tokens).

Monitor Sync Health Proactively¶

Set up alerts in Azure Monitor for:
- Sync Errors: Trigger notifications for critical failures.
- Sync Latency: Track delays in delta sync batches.
- Delta Sync Coverage: Ensure all required objects are included.

Example:
Create a custom alert rule in Azure Monitor for sync errors:

{
  "name": "DeltaSyncErrorAlert",
  "type": "MicrosoftMonitoringAlertRules/alertRule",
  "properties": {
    "description": "Delta sync errors detected.",
    "severity": "Sev2",
    "condition": {
      "allOf": [
        {
          "metricName": "Sync Errors",
          "threshold": 5,
          "timeAggregation": "PT5M"
        }
      ]
    }
  }
}

Key takeaways¶

Logs are critical: Always start troubleshooting with sync logs to pinpoint errors.
Configuration matters: Ensure delta sync is enabled and aligned with your sync frequency needs.
Network reliability: Verify connectivity and firewall rules to avoid sync failures.
Data accuracy: Resolve source data inconsistencies before relying on delta sync.
Proactive monitoring: Use Azure Monitor to detect and address issues before they escalate.