Controls on the "Microsoft Azure AD Connect Agent Updater" schedule?

Question

I have two Entra ID Sync servers, both running their own updater. One server updated the Agent Updater two full weeks prior to the second server. I'm trying to find out why there was such a discrepancy in time.

Is there a way to control how frequently it conducts updates, or even checks?

Answer 1

For the pass-through authentication authentication agent updater, the check frequency is fixed at every hour. The Updater application pings Microsoft Entra hourly to see whether a new authentication agent version is available, verifies the Microsoft signature on the MSI, then stops the agent service, installs the update, and restarts the service.

There is no supported control in the provided documentation to change how often that updater checks or installs updates.

A difference between servers is expected in one documented case: when multiple authentication agents are registered in the same tenant, Microsoft Entra ID does not renew certificates or update them at the same time. It updates them one at a time to help maintain high availability for sign-in requests. That behavior explains why one server can update earlier than another.

If the servers in question are Microsoft Entra Connect Sync servers rather than pass-through authentication agents, the provided documentation only describes scheduler controls for directory synchronization cycles such as the default 30-minute sync interval and Set-ADSyncScheduler options. It does not document any customer control for the Agent Updater schedule itself.

---

References:

• Microsoft Entra pass-through authentication security deep dive
• Microsoft Entra Connect Sync: Scheduler
• Microsoft Entra Connect: Automatic upgrade