Windows AD account sync issue because new users cannot access internal apps

Question

Windows AD account sync issue because new users cannot access internal apps

Sanna Kor 80

Newly created domain accounts in Windows Active Directory are not syncing to the cloud Identity Provider, preventing new users from accessing internal applications.

Onboarded users cannot log in or authenticate to corporate resources, please help with the followings:

1-Guide us on how to trigger/force a manual directory sync (via Microsoft Entra Connect / Azure AD Connect / PowerShell) on the Windows domain controller.

2-Provide steps to verify that newly created AD user attributes are properly exported in the current sync cycle.

0 comments

Answer accepted by question author

Xuan Nhu 1,370 Independent Advisor

Hello Sanna,

Let's get those new users synced up fast before they start chasing you :)

First, open PowerShell as an Administrator on your Microsoft Entra Connect server and kick off an immediate delta sync:

Start-ADSyncSyncCycle -PolicyType Delta

(Note: If you recently made schema changes or added new custom attributes, use -PolicyType Initial instead to run a full sync cycle.)

To verify the new user attributes actually made it to the cloud, open the Synchronization Service Manager(C:\Program Files\Microsoft Azure AD Sync\UIShell\miisclient.exe). Head to the Operations tab, select the latest Export job for your Microsoft Entra ID connector, and check the Export Statistics pane at the bottom, click on Adds to see the exact accounts and attributes pushed live.

Run that command, check the export logs, and those accounts should be ready to log in!

Let me know the results, I'm positive it will work :)

Xuan Nhu.

Sanna Kor 80 Reputation points

2026-09-29T16:19:26.2633333+00:00

Thanks a lot for the detailed steps! I can confirm that this solution worked.

Here’s how it went: I logged into our Microsoft Entra Connect server, fired up PowerShell as Administrator, and executed Start-ADSyncSyncCycle -PolicyType Delta, now all the new accounts and their specific custom attributes were pushed live cleanly without a single error.

1 additional answer

Your answer

Sanna Kor 80 Reputation points

2026-09-29T16:19:26.2633333+00:00

Thanks a lot for the detailed steps! I can confirm that this solution worked.

Here’s how it went: I logged into our Microsoft Entra Connect server, fired up PowerShell as Administrator, and executed Start-ADSyncSyncCycle -PolicyType Delta, now all the new accounts and their specific custom attributes were pushed live cleanly without a single error.

Answer 1

To trigger a manual sync on the Microsoft Entra Connect server, open Windows PowerShell and run:

Start-ADSyncSyncCycle -PolicyType Initial

This starts a full synchronization cycle. If only password synchronization is disabled, enable it first if needed:

Import-Module ADSync
$aadcon = Get-ADSyncConnector | Where {$_.Type -eq "Extensible2"}
Set-ADSyncAADPasswordSyncState -ConnectorName $aadcon.Name -Enable $True

To verify that newly created AD users and their attributes are being exported in the current sync cycle:

On the Microsoft Entra Connect server, open Synchronization Service Manager.
Check the Import from AD step.
In Connection Status, confirm which domain controller is being contacted.
Verify there are no connectivity errors. Common causes include invalid AD connector account credentials, DNS/name resolution issues, blocked ports, packet fragmentation, or no writable domain controller available.
If needed, use preferred domain controllers so the same domain controller is targeted consistently.
Confirm the AD data has replicated to the domain controller that Microsoft Entra Connect is using. Delayed AD replication can prevent recently created or changed objects from being imported.
Use AD Users and Computers to connect directly to that domain controller and verify the new user object and latest attribute values exist there.
If deeper validation is needed, use LDP to bind against the same domain controller with the AD connector account and try to read the failing object or attribute.
Run the Troubleshoot Object Synchronization tool after checking connectivity, because it can detect common reasons an object or attribute does not synchronize.

If the issue is specifically that passwords are not syncing and new users cannot authenticate to cloud-connected apps, check Event Viewer for event ID 6900 with:

Password Synchronization has not been activated for this company

If present, enable password synchronization using the ADSync PowerShell commands shown above.

If attribute values appear in the cloud and then revert a few minutes later, check for multiple active Microsoft Entra Connect servers exporting to Microsoft Entra ID. A stale server can overwrite current changes.
If the issue is limited to specific attributes such as password-change-related behavior, verify whether attribute filtering or custom synchronization rules have disabled the attribute flow. For example, PwdLastSet can be filtered out and may need to be re-enabled in the Microsoft Entra Connect wizard under Optional Features and Microsoft Entra Attributes, followed by:

Start-ADSyncSyncCycle -policyType initial