Build the command you actually need
Pick where you're running it and what you want to happen, then copy. Run it from an elevated PowerShell session. The ADSync module only exists on the Entra Connect server, so remote runs go through Invoke-Command.
Why hasn't my change synced?
Work down the list. These are in rough order of how often each one turns out to be the answer.
-
AD hasn't replicated yet
You changed the user on one domain controller, and Entra Connect reads from another. Wait for AD replication, or force it with
repadmin /syncall /AdeP, then sync. -
The cycle started but hasn't finished
Result: Successonly means the cycle was kicked off. CheckGet-ADSyncConnectorRunStatus. If it returns anything, the sync is still running. -
The object is out of scope
OU filtering or group filtering excludes it. Moving a user to an unsynced OU looks like a delete to Entra, and the cloud account gets soft-deleted.
-
You're on the staging server
A staging-mode server imports and syncs but never exports. Run
Get-ADSyncSchedulerand check thatStagingModeEnabledisFalse. -
The export hit an error
Duplicate UPNs or proxyAddresses are the usual culprits. Open Synchronization Service Manager, select the latest export run, and look at the errors. They also appear in the Entra admin center under Entra Connect.
-
You edited it in the wrong place
For synced objects, on-premises AD is the source of authority. Changes made in the cloud for those attributes either fail or get overwritten on the next cycle.
-
It's a password
Password hash sync runs on its own loop, about every two minutes, separate from the delta cycle. Running a sync cycle won't speed it up.
-
It synced, and the cloud is catching up
Exchange Online, Teams, and especially the offline address book can lag well behind Entra ID. If the change is correct in the Entra admin center, the sync did its job.
Reference
Delta vs. Initial
-PolicyType Delta imports and processes only what changed since the last run. It's what the scheduler runs every 30 minutes by default, and it's what you want nearly every time.
-PolicyType Initial runs a full import and full synchronization on every connector. Save it for after you change sync rules or filtering, since those changes don't apply to existing objects until everything is reevaluated.
Common messages
Sync is already running. Cannot start a new run till this one completes. means exactly that. Wait, or check what's running with Get-ADSyncConnectorRunStatus.
The term 'Start-ADSyncSyncCycle' is not recognized means you're not on the Entra Connect server, or the module isn't loaded. Run Import-Module ADSync or use the remote command above.
Companion cmdlets
| Cmdlet | What it's for |
|---|---|
| Get-ADSyncScheduler | Shows the sync interval, next run time (in UTC), whether the scheduler is enabled, and whether staging mode is on. |
| Set-ADSyncScheduler -SyncCycleEnabled $false | Pauses the scheduler while you make changes. Set it back to $true when you're done. |
| Get-ADSyncConnectorRunStatus | Returns the running connector during a sync. Returns nothing when idle. |
| Stop-ADSyncSyncCycle | Stops the cycle that's currently running. |
| Get-ADSyncConnector | Lists your connectors, including the on-premises AD and Entra ID connector names. |