🔒 Guided

Pre-launch preview. Authorised access only.

Incorrect code

Guided by A Guide to Cloud
Explore AB-900 AI-901
Guided MS-102 Domain 2
Domain 2 — Module 3 of 7 43%
11 of 28 overall

MS-102 Study Guide

Domain 1: Deploy and Manage a Microsoft 365 Tenant

  • Establish and Configure Your M365 Tenant
  • Monitor Tenant Health and Network Readiness
  • Adoption Tracking and Microsoft 365 Backup
  • Manage Users, Contacts and External Identities
  • Groups, Shared Mailboxes and Licensing at Scale
  • Automate with PowerShell: Bulk User Operations
  • Roles, Role Groups and Workload Permissions
  • Delegate with Administrative Units and PIM

Domain 2: Implement and Manage Microsoft Entra Identity and Access

  • Prepare for Identity Synchronization
  • Implement Connect Sync and Cloud Sync
  • Monitor and Troubleshoot Identity Sync
  • Authentication Methods and Self-Service Password Reset
  • Password Protection and Authentication Troubleshooting
  • Entra Identity Protection and Risk Policies
  • Conditional Access and MFA Enforcement

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR

  • Defender XDR: Security Posture and Threat Intelligence
  • Investigate Incidents with Advanced Hunting
  • Defender for Office 365: Threat Policies
  • Email Threats, Attack Simulation and Restricted Entities
  • Defender for Endpoint: Onboard and Protect
  • Vulnerability Management
  • Defender for Cloud Apps: Connect and Govern
  • Cloud App Discovery and Activity Monitoring

Domain 4: Manage Compliance by Using Microsoft Purview

  • Sensitive Information Types and Data Classification
  • Retention Labels and Data Lifecycle
  • Sensitivity Labels and Monitoring
  • DLP Policies Across M365 Workloads
  • Endpoint DLP and Alert Response

MS-102 Study Guide

Domain 1: Deploy and Manage a Microsoft 365 Tenant

  • Establish and Configure Your M365 Tenant
  • Monitor Tenant Health and Network Readiness
  • Adoption Tracking and Microsoft 365 Backup
  • Manage Users, Contacts and External Identities
  • Groups, Shared Mailboxes and Licensing at Scale
  • Automate with PowerShell: Bulk User Operations
  • Roles, Role Groups and Workload Permissions
  • Delegate with Administrative Units and PIM

Domain 2: Implement and Manage Microsoft Entra Identity and Access

  • Prepare for Identity Synchronization
  • Implement Connect Sync and Cloud Sync
  • Monitor and Troubleshoot Identity Sync
  • Authentication Methods and Self-Service Password Reset
  • Password Protection and Authentication Troubleshooting
  • Entra Identity Protection and Risk Policies
  • Conditional Access and MFA Enforcement

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR

  • Defender XDR: Security Posture and Threat Intelligence
  • Investigate Incidents with Advanced Hunting
  • Defender for Office 365: Threat Policies
  • Email Threats, Attack Simulation and Restricted Entities
  • Defender for Endpoint: Onboard and Protect
  • Vulnerability Management
  • Defender for Cloud Apps: Connect and Govern
  • Cloud App Discovery and Activity Monitoring

Domain 4: Manage Compliance by Using Microsoft Purview

  • Sensitive Information Types and Data Classification
  • Retention Labels and Data Lifecycle
  • Sensitivity Labels and Monitoring
  • DLP Policies Across M365 Workloads
  • Endpoint DLP and Alert Response
Domain 2: Implement and Manage Microsoft Entra Identity and Access Premium ⏱ ~15 min read

Monitor and Troubleshoot Identity Sync

Use Microsoft Entra Connect Health to monitor synchronization, diagnose sync errors, and troubleshoot common issues with both Connect Sync and Cloud Sync.

When sync breaks at 2 AM

☕ Simple explanation

Directory sync runs silently in the background — until it doesn’t. Then the helpdesk phones start ringing.

Monitoring sync is like monitoring a water pipe. When it’s working, you don’t think about it. But you need sensors to detect blockages (sync errors), leaks (attribute conflicts), and pressure drops (performance issues) before they become emergencies. Microsoft Entra Connect Health is your sensor dashboard.

Synchronization monitoring involves two complementary approaches:

  • Microsoft Entra Connect Health — a cloud-based monitoring service that provides dashboards, alerts, and diagnostic insights for Connect Sync, AD FS, and AD DS. Requires Entra ID P1+ and a health agent installed on the sync server.
  • Cloud Sync monitoring — built into the Entra admin center. Cloud Sync logs and provisioning status are natively available without additional agents.

Troubleshooting differs between the two tools because of their architectural differences — Connect Sync issues often involve the on-prem server, while Cloud Sync issues are typically agent connectivity or attribute mapping problems.

Monitoring with Microsoft Entra Connect Health

What Connect Health monitors

MetricWhat It ShowsAlert Threshold
Sync statusLast successful sync, current cycle statusAlert if no sync for 2+ hours
Export errorsObjects that failed to sync to EntraAny export error
Sync latencyTime between AD change and Entra updateTypically under 30 minutes
Server healthCPU, memory, disk, network on sync serverResource exhaustion
Password sync statusPassword hash sync success/failureAny PHS failure
AD connectivityConnection to on-prem AD controllersConnection loss

Setting up Connect Health

  1. Install the health agent on the Connect Sync server
  2. Register with your Entra tenant — requires Global Admin or Hybrid Identity Admin
  3. Configure email alerts — Entra > Connect Health > Alert settings
  4. Dashboard available at Entra admin center > Connect Health
ℹ️ Deep dive: Connect Health for AD FS and AD DS

Connect Health isn’t just for sync servers. It also monitors:

  • AD FS servers — sign-in failures, token request latency, server availability, extranet lockouts
  • AD Domain Services — replication health, LDAP queries, DNS errors, domain controller availability

For MS-102, the focus is on sync monitoring, but know that Connect Health is a broader platform. The health agent must be installed on EACH server being monitored (each DC, each AD FS server, etc.).

Monitoring Cloud Sync

Cloud Sync monitoring is simpler — it’s built into the Entra admin center:

WhereWhat You See
Entra > Cloud Sync > Agent statusAgent health, version, last activity
Entra > Cloud Sync > Configuration > LogsProvisioning logs — every object change
Entra > Cloud Sync > Configuration > StatusOverall sync status, errors, warnings
Entra > Audit logsSync-related events

Cloud Sync agents auto-update and report status to Entra continuously. If an agent goes offline, other agents (if deployed) automatically take over.

Common sync errors and fixes

Common Sync Errors: Diagnosis and Resolution
FeatureCauseFix
Duplicate attribute (proxyAddress)Two AD objects share the same email addressIdentify the duplicate in AD, remove or change one. Use IdFix to find duplicates.
Invalid charactersSpecial characters in attributes that Entra doesn't acceptFix the attribute value in AD. Common culprits: trailing spaces, control characters.
UPN conflictSynced UPN matches an existing cloud-only userDelete or rename the cloud-only user, or change the on-prem UPN.
Sync server offlineConnect Sync server is down or unreachableCheck server health, restart sync service, verify network connectivity.
Password hash sync failurePHS agent can't reach Entra endpointsCheck firewall rules, verify outbound HTTPS access, restart PHS.
Orphaned objectsAD object deleted but Entra object remainsCheck deletion threshold settings. Objects go to Entra recycle bin for 30 days.

Dev’s 2 AM troubleshooting scenario

Dev gets an alert: a client’s Cloud Sync agent hasn’t synced for 4 hours. His troubleshooting process:

  1. Check agent status in Entra > Cloud Sync — agent shows “Inactive”
  2. Check the on-prem server — the server is running but the Cloud Sync agent service has stopped
  3. Review Windows Event Log — certificate renewal failed, agent can’t authenticate
  4. Fix: Restart the agent service, re-register if needed
  5. Verify: Check provisioning logs for successful sync after restart
💡 Exam tip: Connect Sync vs Cloud Sync troubleshooting differences

The exam may present a troubleshooting scenario and ask which tool is in use based on the symptoms:

  • “Admin can’t find the staging server” → Connect Sync (Cloud Sync doesn’t have staging servers)
  • “Agent auto-updated and broke” → Cloud Sync (Connect Sync requires manual updates)
  • “Custom sync rule producing unexpected results” → Connect Sync (Cloud Sync doesn’t have custom sync rules)
  • “Multiple agents deployed for high availability” → Cloud Sync (Connect Sync uses staging servers, not multiple agents)

Knowing the architecture helps you identify the tool and the appropriate troubleshooting steps.

Accidental deletion protection

Both sync tools include protection against mass deletions:

  • Connect Sync: Deletion threshold (default: 500 objects per cycle). If more objects would be deleted, sync pauses and alerts the admin.
  • Cloud Sync: Similar protection with configurable thresholds.

If Marcus accidentally removes an OU from the sync scope, the deletion threshold prevents all users in that OU from being deleted in Entra. He gets an alert, reviews the change, and either confirms the deletion or fixes the scope.

Key concepts to remember

Question

What licensing is required for Microsoft Entra Connect Health?

Click or press Enter to reveal answer

Answer

Microsoft Entra ID P1 or higher. The health agent must be installed on each server being monitored (sync server, AD FS servers, domain controllers). Connect Health is included in M365 E3/E5 and EMS E3/E5.

Click to flip back
Question

How does high availability differ between Connect Sync and Cloud Sync?

Click or press Enter to reveal answer

Answer

Connect Sync uses a staging server (manual failover — you must promote the staging server to active). Cloud Sync uses multiple lightweight agents (automatic failover — if one agent goes offline, another automatically handles sync).

Click to flip back
Question

What is the accidental deletion threshold in Connect Sync?

Click or press Enter to reveal answer

Answer

Default: 500 objects per sync cycle. If sync would delete more than 500 objects, it pauses and alerts the admin. This prevents catastrophic data loss from configuration mistakes (e.g., accidentally removing an OU from sync scope).

Click to flip back

Knowledge check

Knowledge Check

Priya receives an alert that Connect Sync hasn't completed a cycle in 3 hours. Connect Health shows the sync server is healthy but the export to Entra ID is failing with 'duplicate attribute' errors for 50 objects. What should Priya investigate first?
Knowledge Check

Dev deployed two Cloud Sync agents for a client's environment. Agent 1 goes offline due to a server reboot. What happens to synchronization?

🎬 Video coming soon

Next up: Authentication Methods and Self-Service Password Reset — from passwordless to SSPR, how users prove who they are.

← Previous

Implement Connect Sync and Cloud Sync

Next →

Authentication Methods and Self-Service Password Reset

Guided

I learn, I simplify, I share.

A Guide to Cloud YouTube Feedback

© 2026 Sutheesh. All rights reserved.

Guided is an independent study resource and is not affiliated with, endorsed by, or officially connected to Microsoft. Microsoft, Azure, and related trademarks are property of Microsoft Corporation. Always verify information against Microsoft Learn.