Entra ID Connect sync Auto upgrade Not working as expected currently on N-1

Question

Entra ID Connect sync Auto upgrade Not working as expected currently on N-1

AJAY PRAJAPATI 60

Hi Experts,

We had a situation where we manually upgraded the Entra ID Connect Sync tool because it was on the Stage server. Since auto-upgrade only functions on the Primary Server, we switched the Stage Server to become the Primary Server after two days to enable auto-upgrading to the latest Entra ID Connect Sync Tool (2.6.3.0).

It has now been two months, and the system still hasn't upgraded to the latest version. Has anyone experienced this situation? If yes, how was it resolved?

Thank you

VEMULA SRISAI 14,065 Reputation points Microsoft External Staff Moderator

2026-06-24T16:43:53.1233333+00:00

AJAY PRAJAPATI I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.

Answer accepted by question author

VEMULA SRISAI 14,065 Microsoft External Staff Moderator

Hello AJAY PRAJAPATI,

This is expected behavior and does not necessarily indicate an issue with your setup.

Auto-upgrade in Microsoft Entra Connect is not immediate and is rolled out in phases. Even if your server is now primary, it will only upgrade once it is eligible and targeted in the rollout. Additionally, not all versions are enabled for auto-upgrade, and some builds require a manual upgrade.

I recommend validating the auto-upgrade status using:

PowerShell

Get-ADSyncAutoUpgrade

Get-ADSyncAutoUpgrade -Detail

Show more lines

Ensure the state is Enabled (not Suspended) and confirm there are no eligibility constraints (custom configuration, connectivity to Entra Connect Health, etc.).

If everything looks healthy and you still need the latest version, the recommended approach is to proceed with a manual in-place upgrade, as auto-upgrade timing is not guaranteed.

AJAY PRAJAPATI 60 Reputation points

2026-06-25T09:50:54.06+00:00

Thank you very much @VEMULA SRISAI

From the above, what I've understood is that upgrades are rolled out in phases. Hence, it could be that we missed the upgrade phase while planning the failover. We expected that when we promoted the staging server to Primary, it would automatically upgrade as well. and this isn't.

Yes, I checked all the commands you mentioned, and all of them returned positive results, including Entra Connect Health.

Hence, since it is only on the N-1 version, we don't need to worry much. We can wait until it gets automatically upgraded in the next auto-upgrade phase.

Thank you again!
VEMULA SRISAI 14,065 Reputation points Microsoft External Staff Moderator

2026-06-25T11:41:22.44+00:00

AJAY PRAJAPATI If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

1 additional answer

Your answer

VEMULA SRISAI 14,065 Reputation points Microsoft External Staff Moderator

2026-06-24T16:43:53.1233333+00:00

AJAY PRAJAPATI I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.
AJAY PRAJAPATI 60 Reputation points

2026-06-25T09:50:54.06+00:00

Thank you very much @VEMULA SRISAI

From the above, what I've understood is that upgrades are rolled out in phases. Hence, it could be that we missed the upgrade phase while planning the failover. We expected that when we promoted the staging server to Primary, it would automatically upgrade as well. and this isn't.

Yes, I checked all the commands you mentioned, and all of them returned positive results, including Entra Connect Health.

Hence, since it is only on the N-1 version, we don't need to worry much. We can wait until it gets automatically upgraded in the next auto-upgrade phase.

Thank you again!
VEMULA SRISAI 14,065 Reputation points Microsoft External Staff Moderator

2026-06-25T11:41:22.44+00:00

AJAY PRAJAPATI If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 1

Automatic upgrade for Microsoft Entra Connect only runs when the installation is both eligible and not in a blocked/suspended state. In this scenario, after promoting the former staging server to primary, the installation is still not auto‑upgrading, which typically means one of the following:

Auto‑upgrade is disabled or suspended
Run on the current primary server:
```
   Get-ADSyncAutoUpgrade
   Get-ADSyncAutoUpgrade -Detail
```
- If the state is Suspended, the detail string usually contains an UpgradeResult such as UpgradeNotSupportedNonLocalDbInstall or UpgradeAbortedSyncExeInUse that explains why auto‑upgrade is not running.
The installation is not eligible for auto‑upgrade
Auto‑upgrade will not proceed if any of the following are true:
- UpgradeNotSupportedTLSVersionIncorrect – TLS < 1.2; update TLS as per the TLS enforcement guide.
- UpgradeNotSupportedCustomizedSyncRules – custom sync rules (no longer blocking after version 2.2.1.0, but may still appear in history).
- UpgradeNotSupportedInvalidPersistedState – installation is not Express settings or a DirSync upgrade.
- UpgradeNotSupportedNonLocalDbInstall – using a full SQL Server instead of SQL Server Express LocalDB.
- UpgradeNotSupportedLocalDbSizeExceeded – LocalDB size ≥ 8 GB.
- UpgradeNotSupportedAADHealthUploadDisabled – Entra Connect Health uploads disabled from the portal.
If Get-ADSyncAutoUpgrade -Detail shows any UpgradeNotSupported* result, the expectation is that the server must be upgraded manually.
Temporary conditions aborting the upgrade
If the result shows UpgradeAborted*, the upgrade was attempted but blocked by a temporary condition, for example:
- UpgradeAbortedSyncExeInUse – Synchronization Service Manager UI open.
- UpgradeAbortedServiceIsNotRunning / UpgradeAbortedServiceCanNotBeStarted / UpgradeAbortedServiceCanNotBeStopped – Entra ID Sync service issues.
- UpgradeAbortedInsufficientDiskSpace – not enough disk space.
- UpgradeAbortedInsufficientDatabasePermissions – built‑in Administrators group lacks database permissions (requires manual upgrade to fix).
These are retried, but if the underlying condition persists, the version will not move to the latest build.
Connectivity to Entra Connect Health / service endpoints
Automatic upgrade uses Microsoft Entra Connect Health. Ensure:
- Required URLs are allowed through proxy/firewall.
- Health agents are configured to use the proxy if applicable.
- Health connectivity tests to Microsoft Entra ID succeed.
Check the event logs for upgrade attempts
On the primary server:
- Open Event Viewer → Application log.
- Filter by Source = Microsoft Entra Connect Upgrade and Event IDs 300–399.
- Review the result codes; they have prefixes such as Success, UpgradeAborted, or UpgradeNotSupported that show why the upgrade did or did not proceed.
When to fall back to manual upgrade
- If the result prefix is UpgradeNotSupported, the expectation is that the system must be upgraded manually and kept current that way.
- If UpgradeAbortedInsufficientDatabasePermissions appears, the guidance is to manually upgrade to the latest version of Microsoft Entra Connect to correct the state.

If, after checking Get-ADSyncAutoUpgrade, eligibility conditions, connectivity, and event logs, the result remains UpgradeNotSupported*, the practical resolution is to perform a manual upgrade to 2.6.3.0 and plan to keep this server updated manually unless the blocking condition can be removed.

References: