What are some Command Prompt or PowerShell command to check if my Azure AD and On-premises really fully synchronized?

Question

Recently, I used AD Connect to synchronized Azure AD and On-premise together, but I am not sure if they really together fully. I did notice that my on premise users are in the Azure AD, but I still wanna see if everything is fully sync using command line. What are some line to check it out make sure there are no error?

Answer 1

Hi there, You can monitor the health of the sync following:

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-sync

enable notifications:

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-operations

Answer 2

@TechQ

Thank you for posting your question in Microsoft Q&A platform.

There are couple of different ways using which you can confirm if the sync is running without any errors.

• You can open "synchronization service" in the AD connect server and go to operations tab to check if there are any errors.
• You can check below articles to get the commands which will help you in getting the error's, https://support.microsoft.com/en-us/topic/you-see-validation-errors-for-users-in-the-office-365-portal-or-in-the-azure-active-directory-module-for-windows-powershell-5c3bf8f7-de1b-6f51-6623-3c005d1f5900 https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-syncservice-duplicate-attribute-resiliency#identifying-objects-with-dirsyncprovisioningerrors
• Apart from above 2 ways you can also enable AD connect health agent alerts, which will keep track of the sync status and will send an email to you once there is any error that gets triggered while sync.
• You will have to enable this notification in AD connect health option in Azure AD portal. To enable email, you can follow below steps,
  1. In the Azure Portal, search for Azure AD Connect Health
  2. Select Sync errors
  3. Select Notification Settings.
  4. At the email notification switch, select ON.
  5. Select the check box if you want all Hybrid Identity Administrators to receive email notifications.
  6. If you want to receive email notifications at any other email addresses, specify them in the Additional Email Recipients box. To remove an email address from this list, right-click the entry and select Delete.
  7. To finalize the changes, click Save. Changes take effect only after you save.

You can also refer to below article to understand what kind of alerts are sent by health agent,

https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/active-directory/hybrid/how-to-connect-health-alert-catalog.md#alerts-for-azure-ad-connect-sync

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.