# Entra Connect Application-Based Authentication by 7 April 2027: What Changes, Which Versions Keep Syncing, and How to Switch an Existing Server

> Entra Connect Sync stops on 7 April 2027 below 2.6.84.0 without application-based authentication. The version ladder, and how to switch a live server.

Canonical: https://o365hq.com/blog/entra-connect-application-based-authentication-by-7-april-2027-what-changes-and-how-to-switch
Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book

Published: 2026-10-18 · IT Partner

On 7 April 2027 Microsoft retires the service-account sign-in Entra Connect Sync uses; a server not on version 2.6.84.0 or later with application-based authentication configured stops synchronizing. What changes, which versions keep syncing, and how to switch a production server without an outage.

## The deadline in one paragraph: 7 April 2027, version 2.6.84.0, application-based authentication

On 7 April 2027 Microsoft retires the legacy sign-in Microsoft Entra Connect Sync uses to reach the tenant. From that date a server not on version 2.6.84.0 or later with application-based authentication configured stops synchronizing: Microsoft's hardening page says all synchronization services fail until the server is upgraded and switched. Users keep signing in under Password Hash Sync, but new accounts, attribute changes, group membership and password changes stop reaching the cloud.

The version bar is 2.6.84.0, released 7 July 2026. The build to install at the time of writing is 2.6.92.0, released 23 September 2026, because 2.6.84.0 carries a known upgrade failure against an existing database.

The fix in one sentence: upgrade to the current build, run the wizard task **Configure application-based authentication to Microsoft Entra ID**, confirm with `Get-ADSyncEntraConnectorCredential` that the identity type reads Application, and remove the old service account after the rollback window. If the server is a domain controller you are retiring, build the replacement first: a new installation is switched during setup, and the staging-mode swap in our companion article on [moving Entra Connect off a retiring domain controller](/blog/moving-entra-connect-off-a-domain-controller-you-are-retiring) carries it.

## What application-based authentication is, and why the service-account sign-in is being retired

Today's model is a user account: at installation the wizard creates a Microsoft Entra Connector account in the tenant, with a long password that never expires and the built-in Directory Synchronization Accounts role, which only the wizard can grant. Every export, password hash and writeback call uses that username and password; each staging server gets its own account. It is a credential nobody rotates, that cannot be made phishing-resistant, and that carries exactly the permission an attacker wants.

Application-based authentication replaces the account with an application identity: the server authenticates as a single-tenant application registered in Microsoft Entra ID, with a certificate rather than a password. A first-party service principal named Microsoft Entra AD Synchronization Service (application ID 6bf85cfa-ac8a-4be5-b5de-425a0d0dc016) appears under Enterprise applications, and the server's application is granted a role on it. In the default, Managed by Microsoft Entra Connect, the server creates a 90-day certificate, backs it with the TPM when one is present or a non-exportable software key when not, and rotates it through the scheduler. Bring Your Own Certificate and Bring Your Own Application hand the certificate, or the whole app registration, to you, through PowerShell. Microsoft recommends the default, and it explains the retirement: a certificate that rotates itself, hardware-bound where a TPM exists, cannot be phished and is never forgotten.

## The version ladder: which builds keep syncing after 7 April 2027

Every 2.x build retires twelve months after the next one ships, a policy in force since 15 March 2023; every 1.x build is already non-functional. Microsoft's release history as updated on 23 September 2026:

| Your build | Status at the time of writing | What to do |
|---|---|---|
| Any 1.x | Unsupported; synchronization does not function | New server, current build, swing migration |
| 2.x below 2.5.79.0 | Retired; auto-upgrade needs 2.3.20.0 or later | Manual upgrade, or swing to a new server |
| 2.5.79.0 | Retires 23 October 2026 | Upgrade to the current build |
| 2.5.190.0, 2.6.1.0, 2.6.3.0 | Supported until 2 February, 10 March and 7 July 2027, but below the bar | Upgrade before 7 April 2027; supported is not compliant |
| 2.6.84.0 | The minimum; retires 16 September 2027; upgrading over an existing database can fail (error 0xE0474352) | Skip it; install 2.6.91.0 or later |
| 2.6.91.0 | Retires 23 September 2027; pass-through authentication wizard bug | Stay unless enabling pass-through authentication |
| 2.6.92.0 | Current; hotfix of 23 September 2026, download only | Install this one |

Two caveats. The build is necessary but not sufficient: a server on 2.6.92.0 whose `Get-ADSyncEntraConnectorCredential` still returns ServiceAccount stops on 7 April 2027 like any other. And auto-upgrade will not get you there alone: it reaches only eligible express installations, carries only builds Microsoft marks for it (2.6.84.0 and later are listed as download only), and since 2.6.84.0 never switches an existing server to application-based authentication in the background. Leave it on, but plan the April change as a manual one.

## The switch, step by step: in place, or on a replacement server

**In place**, for a member server on a supported operating system.

1. **Record the state.** **Tasks** > **View or export current configuration** shows either an account name or an application (client) ID with certificate details; `Get-ADSyncEntraConnectorCredential` says the same. Export the settings file. Confirm .NET Framework 4.7.2, TLS 1.2 and a ready TPM 2.0 (`Get-Tpm`; a Hyper-V guest must be generation 2).
2. **Upgrade in place** with the 2.6.92.0 installer from the Microsoft Entra admin center. A full import and synchronization may follow; delta sync pauses meanwhile but password synchronization continues. An in-place upgrade cannot be rolled back.
3. **Switch the identity.** The managed application is set up during a new installation or a manual interactive upgrade, never in the background since 2.6.84.0. Check `Get-ADSyncEntraConnectorCredential` again; if it still reads ServiceAccount, run **Additional tasks** > **Configure application-based authentication to Microsoft Entra ID** as a Hybrid Identity Administrator.
4. **Keep the old account through the rollback window, then remove it** with `Remove-ADSyncAADServiceAccount`. Rollback: disable the scheduler, `Add-ADSyncAADServiceAccount` (up to 15 minutes to take effect), confirm ServiceAccount, re-enable the scheduler. It only works before 7 April 2027.

**On a replacement server**, for a domain controller due for demotion or an operating system leaving support: build a Windows Server 2025 member server as a generation 2 virtual machine with a virtual TPM, install 2.6.92.0 in staging mode from the exported settings, and let setup register the application; a new installation reads Application before it exports anything. The comparison export, swap order and rollback window are in the [companion article](/blog/moving-entra-connect-off-a-domain-controller-you-are-retiring).

## What to check afterwards

The identity type is the first check, not the last.

**Sync cycle.** `Get-ADSyncScheduler` shows SyncCycleEnabled True and not suspended; certificate rotation depends on it. A test attribute change reaches the cloud within the 30-minute delta interval.

**Password Hash Sync.** Change a test password on-premises and sign in within minutes. Version 2.6.84.0 removed the self-healing that re-enabled the cloud feature flag; if it is off, an administrator turns it on explicitly.

**Password writeback.** A self-service reset on a test account changes pwdLastSet on-premises; under Bring Your Own Application, the three password-reset application roles must be on your application.

**Device writeback.** Unchanged, but a newly registered device still has to appear in RegisteredDevices.

**Seamless single sign-on.** Untouched: it rests on the AZUREADSSO computer account in Active Directory. Its Kerberos decryption key still needs rolling at least every 30 days with `Update-AzureADSSOForest`, once per forest, never on a staging server.

**The application in Microsoft Entra.** Enterprise applications shows the first-party Microsoft Entra AD Synchronization Service; App registrations shows the server's own application by its client ID. Version 2.6.91.0 added Microsoft Graph permissions, so review app-scoped Conditional Access policies that target Microsoft.Azure.SyncFabric.

**Certificate expiry and rotation.** The managed certificate lives 90 days; warning event 1011 appears around day 63 and error 1012 once it has expired. Rotation is automatic when the server manages the certificate; if the old credential lingers, `Remove-EntraApplicationKey` clears it, and **Additional tasks** > **Rotate application certificate** forces a new one.

## Worked example: switching while the sync server leaves a retiring domain controller

A hardware manufacturer with six sites on three continents runs one forest and one domain on about ten Windows Server 2016 domain controllers, with Entra Connect, Password Hash Sync and password writeback on one of them, on a 2.x build below the hardening bar. Replacing the domain controllers is Phase 1 of a two-phase plan due to finish before 12 January 2027, so the 7 April 2027 bar is folded into that change rather than a second one.

The plan in progress: a Windows Server 2025 member server, built as a generation 2 virtual machine so a virtual TPM backs the managed certificate, receives 2.6.92.0 in staging mode from the settings exported off the domain controller. As a new installation it registers its application during setup; `Get-ADSyncEntraConnectorCredential` reads Application and the certificate shows the platform crypto provider, both recorded in the runbook with the not-valid-after date. After the comparison export is reviewed, the swap takes a daytime window separate from the three overnight domain controller windows.

The old domain controller stays staged for a week as the rollback, still on its legacy account. Then Entra Connect is uninstalled, and only then is the domain controller demoted and its address moved to the replacement, in the order the [replacement plan for Windows Server 2016 domain controllers](/blog/replacing-windows-server-2016-domain-controllers-with-windows-server-2025-order-of-operations) sets out. The April bar is met before the first domain controller is demoted; Phase 2 contains no Entra Connect change.

## What it costs

Entra Connect carries no Microsoft charge, and neither does application-based authentication. Microsoft Entra ID P1 for password and device writeback and a Windows Server 2025 license for a new member server are yours, as is any Azure meter, such as Arc add-ons, which Microsoft bills to you.

For one server, the switch sits inside [Domain Services and Active Directory Roles Migration](/services/active-directory-domain-controller-migration), $900 per project over three days: the retiring server's roles, DNS and DHCP moved to a replacement, the Entra Connect staging build and swap, and application-based authentication verified before the old server is demoted. For an estate, it is a line item in [Multi-Site Domain Controller Migration to Windows Server 2025](/services/multi-site-domain-controller-migration-windows-server-2025), from $12,500 over eight weeks for one forest, up to six sites and fourteen domain controllers.

If Active Directory may not stay at all, the [cloud-only path](/blog/retiring-on-premises-active-directory-going-cloud-only-with-entra-id-and-intune) retires the sync server instead of switching it: [On-premises Active Directory to Microsoft Entra ID Transition](/services/on-prem-active-directory-to-microsoft-entra-id-transition), $4,950 per project over three weeks. Federated tenants move sign-in first: [AD FS to Microsoft Entra ID Migration](/services/ad-fs-to-microsoft-entra-id-migration), $4,950 per project over four weeks.

## Frequently asked questions

### What is the Entra Connect deadline in April 2027?

7 April 2027. A server below 2.6.84.0, or still on the legacy service account, stops synchronizing that day until it is upgraded and switched. Users keep signing in; changes stop flowing.

### Which Entra Connect version do we need?

2.6.84.0 is the minimum. Install 2.6.92.0, current at the time of writing; 2.6.84.0 can fail to upgrade an existing database. Then confirm the identity type reads Application; the build alone is not enough.

### What is application-based authentication, and does it break Password Hash Sync?

The server authenticates to Microsoft Entra ID as a single-tenant application with a certificate instead of as a user with a password. Password Hash Sync, password writeback and the other features ride on the same connector and keep working. Seamless single sign-on is untouched.

### How do we switch an existing server without an outage?

Upgrade in place, run the wizard task, verify, and keep the old account through a rollback window. Password Hash Sync keeps authenticating against hashes already in the cloud, and at most one sync cycle of changes waits. A replacement server is built in staging mode, switched from the start, and swapped in minutes.

### Will auto-upgrade handle it for us?

No. Auto-upgrade reaches only eligible express installations, carries only the builds Microsoft marks for it, and since 2.6.84.0 never switches an existing server's identity in the background. Plan the upgrade and the wizard task as your own change.

## Sources

- Microsoft Learn, "Hardening update to Microsoft Entra Connect Sync" (entra/identity/hybrid/connect/harden-update-ad-fs-pingfederate), updated 30 September 2026, retrieved October 2026
- Microsoft Learn, "Authenticate to Microsoft Entra ID by using application identity" (entra/identity/hybrid/connect/authenticate-application-id), updated 24 July 2025, retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Version release history" (entra/identity/hybrid/connect/reference-connect-version-history), updated 23 September 2026, retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Upgrade from a previous version to the latest" (entra/identity/hybrid/connect/how-to-upgrade-previous-version), updated 17 September 2025, retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Automatic upgrade" (entra/identity/hybrid/connect/how-to-connect-install-automatic-upgrade), updated 9 April 2025, retrieved October 2026
- Microsoft Learn, "Security improvements to Microsoft Entra Connect Sync autoupgrade and Microsoft Entra Connect Health alerts" (entra/identity/hybrid/connect/security-updates-pks), updated 17 September 2025, retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Accounts and permissions" (entra/identity/hybrid/connect/reference-connect-accounts-permissions), updated 9 April 2025, retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Prerequisites and hardware" (entra/identity/hybrid/connect/how-to-connect-install-prerequisites), updated 16 January 2026, retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Staging server and disaster recovery" (entra/identity/hybrid/connect/how-to-connect-sync-staging-server), retrieved October 2026
- Microsoft Learn, "Microsoft Entra seamless single sign-on: Frequently asked questions" (entra/identity/hybrid/connect/how-to-connect-sso-faq), retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Enabling device writeback" (entra/identity/hybrid/connect/how-to-connect-device-writeback), updated 9 April 2025, retrieved October 2026
- IT Partner Microsoft deadlines page: Entra Connect Sync minimum version enforcement, Windows Server 2016 end of extended support

## Key takeaways

- 7 April 2027: a server below 2.6.84.0, or still on the legacy service account, stops synchronizing until it is upgraded and switched.
- Install 2.6.92.0, current at the time of writing; 2.6.84.0 is the minimum but can fail to upgrade an existing database.
- Application-based authentication swaps a never-expiring password for a 90-day certificate the server rotates itself; Get-ADSyncEntraConnectorCredential must read Application.
- In place: upgrade, wizard task, verify, remove the old account after the rollback window. Replacement: a staging-mode installation is switched from the start.
- Auto-upgrade does not deliver the switch; Password Hash Sync, writeback and seamless single sign-on keep working, each with its own test.

---

**Is your Entra Connect server below 2.6.84.0, or on a domain controller you are about to demote?** Across several sites, [Multi-Site Domain Controller Migration to Windows Server 2025](/services/multi-site-domain-controller-migration-windows-server-2025) carries the switch inside the replacement plan. For one server, [Domain Services and Active Directory Roles Migration](/services/active-directory-domain-controller-migration) switches the sync server and moves it off the retiring domain controller for $900 per project in three days, quoted in writing before work starts; the other Microsoft dates are on our [deadlines page](/deadlines).