I am having a having an issue with on-premise AD to Entra sync

Question

We are seeing error messages when trying to complete either full or delta syncs from our on-premise AD server to Entra.

Answer 1

Hi CMIT Admin,

Thank you for sharing the error messages — I really appreciate the detail you've provided. Based on your description, you're encountering a "Sync Generic Failure" during both full and delta syncs from your on-premises Active Directory to Microsoft Entra. This error occurs during the Provisioning step and is tied to the SyncRulesEngine extension.

---

1. Possible Causes

Sync Rules Misconfiguration A synchronization rule may be failing due to a missing or filtered attribute, or a transformation issue. ➤ Use the Provisioning Preview in the Synchronization Service Manager to identify which rule or attribute is causing the failure.

User Not Exported As you noted, this could be due to the user being filtered out by a sync rule or blocked by the deletion threshold.

Deletion Threshold Blocking Export If a large number of deletions are detected, Microsoft Entra Connect will halt the export to prevent accidental mass deletions. ➤ You can review and adjust this setting using the guidance in Prevent Accidental Deletes – Microsoft Docs.

Connectivity Requirements Ensure that TLS 1.2 is enabled and that port 443 is open for outbound traffic. These are required for secure communication with Microsoft Entra.

2. Recommended Next Steps

Open Synchronization Service Manager → locate the affected object → click Provisioning Preview to view the exact rule failure. Review the Sync Rules Editor for any custom rules that might be filtering or transforming attributes incorrectly. Verify the deletion threshold settings to confirm whether the sync engine is blocking exports due to too many deletions. Confirm that TLS 1.2 is enabled and port 443 is not blocked by a firewall or proxy.

---

Please let me know if this helps or if you have any further questions — I’m here to assist you every step of the way!

If this response has been helpful, I’d be truly grateful if you could mark it as the accepted answer and give it a thumbs up under "Was this helpful?" — your feedback means a lot and helps us continue to improve the support experience.

Warm regards,

Bob

Answer 2

Hello CMIT Admin,

If you're encountering the "Sync Generic Failure" error in Microsoft Entra Connect, here are common ways to solve this-:

1. Perform a Full Synchronization-:Initiating a full synchronization can often resolve persistent synchronization issues:

Start-ADSyncSyncCycle -PolicyType Initial

This command will perform a full synchronization, potentially clear any cached objects and resolving underlying issues.

2)Ensure TLS 1.2 is Enabled-:,Microsoft Entra Connect requires TLS 1.2 for secure communication. If it's not enabled on your server, please refer to the official documentation to enable it:

Check if TLS 1.2 is enabled
Enable TLS 1.2

3)Verify Synchronization Service Account Permissions-:Ensure that the synchronization service account has the necessary permissions and is not restricted by Conditional Access policies. Lack of appropriate permissions can lead to synchronization failures.

4)Address Deletion Threshold Exceeded-:Azure AD Connect has a security feature that prevents accidental mass deletions by stopping synchronization if more than 500 objects are deleted within a short period.

Here are the steps:

Open PowerShell as an Administrator on the server with Azure AD Connect installed.

Check the current deletion threshold:

Get-ADSyncExportDeletionThreshold

Temporarily disable the deletion threshold:

Disable-ADSyncExportDeletionThreshold

Force a synchronization:

Start-ADSyncSyncCycle -PolicyType Delta

After synchronization completes, re-enable the deletion threshold:

Enable-ADSyncExportDeletionThreshold -DeletionThreshold 500

This process should allow synchronization to resume.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.