Hybrid Sync Health

The question it answers: When did Entra Connect last sync directory objects and password hashes, and which sync protections are on?

When Entra Connect stops syncing, nothing breaks loudly: leavers disabled on-premises stay enabled in Microsoft 365, and password changes stop flowing. This page shows when sync and password hash sync last ran and which protections are on.

Note

Provisioning errors on individual users are in the existing ‘OnPrem Provisioning Errors’ report.

At a glance

Where in the app	Entra ID › Identity Hygiene › Hybrid Sync Health
Workload	Entra ID
Kind	Findings list · dashboard tile
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	No extra licence needed.
Report id (API and MCP)	entra.security.hybrid-sync-health

Columns

Column	Key	Type
Severity	Severity	Status
Area	Category	Text
Subject	Subject	Link
Setting	Setting	Text
Current value	Value	Text
Assessment	Finding	Text
Detail	Detail	Text
Date	When	Date
Count	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Organization.Read.All	Microsoft Graph	Read organization information
OnPremDirectorySynchronization.Read.All	Microsoft Graph	Read all on-premises directory synchronization information

Data sources it reads

• GET /v1.0/organization
• GET /v1.0/directory/onPremisesSynchronization

Through the API and MCP

GET /ir-api/v1/reports/entra.security.hybrid-sync-health?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.hybrid-sync-health. The client needs the Read grant for Entra ID. See Using the API.