**AADDS500 – Entra Domain Services sync stopped since June 1st 2026**

Question

Environment

• Tenant: xxx (Germany West Central)
• SKU: Enterprise
• syncScope: CloudOnly (no on-premises AD, no Entra Connect)
• Domain Controllers: Running, 10.200.2.5 / 10.200.2.4

Problem

Since June 1st 2026, the AADDS500 alert is active on our managed domain. The Health page shows "Last synchronized: May 30th 2026" – exactly before Microsoft's MFA enforcement rollout.

What we have checked and ruled out

• Config Diagnostics (all validators OK as of 2026-06-10T10:17:30Z): AADDS-CFG-DIAG-V01/V02/V04/V05/V06 all status OK
• No other active alerts besides AADDS500
• No NSG rules, UDRs, firewalls, NVA, or forced tunneling on the aadds-subnet
• No resource locks or Azure Policies on the resource or resource group
• Service Principal "Domain Controller Services" (AppId: 2565bd9d-da50-47d4-8b85-4c97f669dc36): AccountEnabled = True
• Service Principal "Azure AD Domain Services Sync" (AppId: 507ed23b-2c6b-432c-bd4a-efb340c8c18c): AccountEnabled = True
• provisioningState: Succeeded
• serviceStatus: Running
• OnPremisesSyncEnabled on tenant: False
• No users with OnPremisesImmutableId set
• kerberosRc4Encryption: Disabled (no CVE-2026-20833 issue)
• LDAPS certificate valid until 2026-10-28

Notable finding

On May 28th 2026 at 03:56 UTC, a PATCH was made to the Domain Services resource via Azure Portal (API version 2025-06-01). Due to limitations in Resource Graph (Microsoft.AAD/domainServices is not supported for change tracking) and Activity Log (no field-level diff stored), the exact change cannot be determined and may or may not be related to the issue.

The last successful sync was May 30th – two days after this change and one day before the MFA enforcement rollout on June 1st. Given that all external checks are clean and the timing aligns precisely with the MFA enforcement rollout, we suspect this may be a Microsoft-side issue with the internal sync pipeline.

Question

Is there a known issue with Entra Domain Services sync being blocked by the MFA enforcement rollout from June 1st 2026? The internal sync pipeline between Entra ID and the managed domain does not appear in sign-in logs, making it impossible to diagnose further from our side. Is there anything we can do without a paid support plan, or is this a Microsoft-side issue requiring escalation?

Answer 1

Hey Stefan, it’s very unlikely that the June 1 MFA enforcement rollout is blocking the managed‐domain sync. AADDS uses service principals under the covers (not user sign-ins), and MFA policies don’t apply to those. The AADDS500 alert simply means your managed domain’s background sync from Entra ID hasn’t run in a while.

Here’s what you can try:

1. Trigger a full re-sync by forcing a config update • Use Azure CLI or Portal to PATCH any innocuous property on the AAD DS resource (for example, add/update a tag or re-upload your LDAPS cert). • This kicks off a full provisioning run. Wait 1–2 hours and check the Health page again.
2. Verify password hash sync is enabled for cloud-only accounts • Even in a CloudOnly instance, AAD DS needs Azure AD password hashes for NTLM/Kerberos. • If you didn’t explicitly enable it at creation, run the tutorial steps under “Enable user accounts for Azure AD DS” to ensure password sync is on.
3. Review network and service-principal health • Confirm there are no intermittent connectivity issues on the vNet (even though NSGs/UDRs look clean). • Use the “Check health in Azure AD DS” blade to ensure both DC service principals are healthy.
4. If sync still won’t resume, engage Microsoft support • Because the sync pipeline is fully managed in the Microsoft service fabric, any server-side outages or bugs require Microsoft intervention. • If you don’t have a paid plan, you can open a free billing support request via Azure Service Health → “Get support” and ask them to escalate to the AAD DS engineering team.

Hope this helps get your sync moving again!

References:

https://docs.microsoft.com/azure/active-directory-domain-services/synchronization#common-errors-and-resolutions

https://docs.microsoft.com/azure/active-directory-domain-services/network-considerations

https://docs.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication#scope-of-enforcement