📋 Microsoft Entra Documentation Changes

---

title: Install the Microsoft Entra Connect Health agents in Microsoft Entra ID

description: Learn how to install the Microsoft Entra Connect Health agents for Active Directory Federation Services (AD FS) and for sync.

ms.subservice: hybrid-connect

ms.tgt_pltfrm: na

ms.date: 05/15/2026

ms.topic: how-to

---

# Install the Microsoft Entra Connect Health agents

 

> [!NOTE]

> Microsoft Entra Connect Health is not available in the China sovereign cloud.

 

 

The following table lists requirements for using Microsoft Entra Connect Health:

 

| You have a Microsoft Entra ID P1 or P2 subscription. |Microsoft Entra Connect Health is a feature of Microsoft Entra ID P1 or P2. For more information, see [Sign up for Microsoft Entra ID P1 or P2](~/fundamentals/get-started-premium.md). <br /><br />To start a free 30-day trial, see [Start a trial](https://azure.microsoft.com/trial/get-started-active-directory/). |

| You're either a [Global Administrator](../../role-based-access-control/permissions-reference.md#global-administrator) or a [Hybrid Identity Administrator](../../role-based-access-control/permissions-reference.md#hybrid-identity-administrator) in Microsoft Entra ID. | By using Azure role-based access control (Azure RBAC), you can allow other users in your organization to access Microsoft Entra Connect Health. For more information, see [Azure RBAC for Microsoft Entra Connect Health](how-to-connect-health-operations.md#manage-access-with-azure-rbac). <br /><br />**Important**: Use a work or school account to install the agents. You can't use a Microsoft account to install the agents. For more information, see [Sign up for Azure as an organization](~/fundamentals/sign-up-organization.md). |

---

title: Microsoft Entra Connect Health agents for AD FS

description: This is the Microsoft Entra Connect Health page how to monitor your on-premises AD FS infrastructure.

ms.reviewer: zhiweiwangmsft

ms.assetid: dc0e53d8-403e-462a-9543-164eaa7dd8b3

ms.subservice: hybrid-connect

ms.tgt_pltfrm: na

ms.topic: how-to

ms.date: 05/15/2026

---

 

# Microsoft Entra Connect Health agents for AD FS

> [!NOTE]

> Microsoft Entra Connect Health is not available in the China sovereign cloud.

 

 

The following table lists requirements for using Microsoft Entra Connect Health:

 

---

title: AD FS sign-ins in Microsoft Entra ID with Connect Health

description: This document describes how to integrate AD FS sign-ins with the Microsoft Entra Connect Health sign-ins report.

ms.subservice: hybrid-connect

ms.tgt_pltfrm: na

ms.topic: how-to

ms.date: 05/15/2026

---

 

# AD FS sign-ins in Microsoft Entra ID with Connect Health - preview

The Connect Health for AD FS agent correlates multiple Event IDs from AD FS, dependent on the server version, to provide information about the request and error details if the request fails. This information is correlated to the Microsoft Entra sign-in report schema and displayed in the Microsoft Entra sign-in report UX. Alongside the report, a new Log Analytics stream is available with the AD FS data and a new Azure Monitor Workbook template. The template can be used and modified for an in-depth analysis for scenarios such as AD FS account lockouts, bad password attempts, and spikes of unexpected sign-in attempts.

 

## Prerequisites

 

## What data is displayed in the report?

The data available mirrors the same data available for Microsoft Entra sign-ins. Five tabs with information are available based on the type of sign-in, either Microsoft Entra ID or AD FS. Connect Health correlates events from AD FS, dependent on the server version, and matches them to the AD FS schema.

 

---

title: Using Microsoft Entra Connect Health with sync

description: This is the Microsoft Entra Connect Health page that discusses how to monitor Microsoft Entra Connect Sync.

ms.assetid: 1dfbeaba-bda2-4f68-ac89-1dbfaf5b4015

ms.subservice: hybrid-connect

ms.tgt_pltfrm: na

ms.topic: how-to

ms.date: 05/15/2026

---

# Monitor Microsoft Entra Connect Sync with Microsoft Entra Connect Health

The following documentation is specific to monitoring Microsoft Entra Connect (Sync) with Microsoft Entra Connect Health. For information on monitoring AD FS with Microsoft Entra Connect Health see [Using Microsoft Entra Connect Health with AD FS](how-to-connect-health-adfs.md). Additionally, for information on monitoring Active Directory Domain Services with Microsoft Entra Connect Health see [Using Microsoft Entra Connect Health with AD DS](how-to-connect-health-adds.md).

## Object Level Synchronization Error Report

This feature provides a report about synchronization errors that can occur when identity data is synchronized between Windows Server AD and Microsoft Entra ID using Microsoft Entra Connect.

 

* It includes the errors that occurred in the last synchronization operation on the sync engine. ("Export" on the Microsoft Entra Connector.)

* Microsoft Entra Connect Health agent for sync must have outbound connectivity to the required end points for the report to include the latest data.

* The report is **updated after every 30 minutes** using the data uploaded by Microsoft Entra Connect Health agent for sync.

For specific duplicated attribute sync error scenario involving user Source Anchor update, you can fix them directly from the portal.

---

title: Microsoft Entra Connect Health with AD FS risky IP report workbook

description: Describes the Microsoft Entra Connect Health AD FS risky IP report with Azure Monitor Workbooks.

ms.subservice: hybrid-connect

ms.tgt_pltfrm: na

ms.topic: how-to

ms.date: 05/15/2026

ms.collection:

---

 

 

- Customizable queries and expanded visualizations for further analysis

- Expanded functionality from the previous Risky IP report, which was deprecated after January 24, 2022.

 

1. Connect Health for AD FS installed and updated to the latest agent.

2. A Log Analytics Workspace with the "ADFSSignInLogs" stream enabled.

3. Permissions to use the Microsoft Entra ID Monitor Workbooks. To use Workbooks, you need:

- Ensure no "Health service isn't up to date" alert active in your AD FS server list. Read more about [how to troubleshoot this alert](how-to-connect-health-data-freshness.md)

 

Using dynamic membership groups requires a Microsoft Entra ID P1 license or an Intune for Education license. For more information, see [Manage rules for dynamic membership groups in Microsoft Entra ID](./groups-dynamic-membership.md).

 

## Rule builder in the Azure portal

 

Microsoft Entra ID provides a rule builder to create and update your important rules more quickly. The rule builder supports the construction of up to five expressions.

> [!IMPORTANT]

> Microsoft doesn't support modifying or operating Microsoft Entra Cloud Sync outside of the configurations or actions that are formally documented. Any of these configurations or actions might result in an inconsistent or unsupported state of Microsoft Entra Cloud Sync. As a result, Microsoft can't provide technical support for such deployments.

 

## Things to remember about all scenarios and topologies

The following information should be kept in mind, when selecting a solution.

 

ms.subservice: hybrid-connect

ms.tgt_pltfrm: na

ms.topic: how-to

ms.custom: sfi-image-nochange

---

# Using Microsoft Entra Connect Health with AD DS

 

For more information on monitoring AD FS with Microsoft Entra Connect Health, see [Using Microsoft Entra Connect Health with AD FS](how-to-connect-health-adfs.md). Additionally, for information on monitoring Microsoft Entra Connect (Sync) with Microsoft Entra Connect Health see [Using Microsoft Entra Connect Health for Sync](how-to-connect-health-sync.md).

 

title: User Administrator

description: User Administrator

ms.topic: include

ms.custom: include file

---

 

> | microsoft.directory/contacts/delete | Delete contacts |

> | microsoft.directory/deletedItems.groups/restore | Restore soft deleted groups to original state |

> | microsoft.directory/deletedItems.users/restore | Restore soft deleted users to original state |

> | microsoft.directory/groups.unified/assignedLabels/update | Update the assigned labels property on Microsoft 365 groups of assigned membership type, excluding role-assignable groups |

> | microsoft.directory/groups/assignLicense | Assign product licenses to groups for group-based licensing |

> | microsoft.directory/groups/basic/update | Update basic properties on Security groups and Microsoft 365 groups, excluding role-assignable groups |

 

## Inheritable permissions limitations

 

 

Regularly review and monitor your inheritable permissions configuration. Reevaluate inherited scopes and roles to ensure they remain appropriate for your use case. Audit which inherited scopes and roles are being used by agents and remove any unused permissions from both the agent identity blueprint principal and the inheritable permissions list to maintain security hygiene.

 

- Installing multiple agents provides high availability of sign-in requests.

- It [protects](~/identity/authentication/howto-password-smart-lockout.md) your on-premises accounts against brute force password attacks in the cloud.

 

 

When a pass-through sign-in attempt from Tenant A (for example, Contoso) to Tenant B (for example, Fabrikam) fails, Microsoft Entra ID publishes the sign-in log to both tenants. For failed attempts, Microsoft Entra ID doesn't expose personally identifiable information (PII) to Tenant B, because the user in Tenant A never consented to share their identity with Tenant B. In these cases, attributes like the user principal name (UPN) are replaced with unresolved GUIDs.

 

* Make sure that Microsoft Entra Connect Health Agents services are **running** on the machine. For example, Connect Health for AD FS should have two services.


 

* Use [test connectivity tool](how-to-connect-health-agent-install.md#test-connectivity-to-azure-ad-connect-health-service) to discover connectivity issues.

* If you have an HTTP Proxy, follow these [configuration steps](how-to-connect-health-agent-install.md#configure-azure-ad-connect-health-agents-to-use-http-proxy).

 

<a name='download-and-install-azure-ad-connect-health-agent'></a>

 

## Download and install Microsoft Entra Connect Health Agent

* Get started using Microsoft Entra Connect Health for AD FS

* [Download Microsoft Entra Connect Health Agent for AD FS.](https://www.microsoft.com/en-us/download/details.aspx?id=108565)

* [See the installation instructions](how-to-connect-health-agent-install.md#install-the-agent-for-ad-fs).

<a name='7b---endpoints-for-azure-ad-connect-health-agent-for-ad-fssync-and-azure-ad'></a>

 

### 7b - Endpoints for Microsoft Entra Connect Health agent for (AD FS/Sync) and Microsoft Entra ID