Upgrade Entra Connect Sync before April 2027 and move users off Microsoft's SMS codes

Two Microsoft Entra changes land in the same few months, and both can stop people working. Entra Connect SyncdefinitionThe Windows program that copies users, groups and password hashes from on-premises Active Directory to Entra ID. You'll still see its old name, Azure AD Connect, in plenty of places. servers have to run version 2.6.84.0 or later, signed in with application-based authenticationdefinitionThe new way Connect Sync signs in to Entra ID: an app registration with a certificate credential instead of the Sync_ user account and its password., by 7 April 2027. Microsoft also stops sending its own SMS and voice MFA codes from 1 February 2027. Upgrade your sync servers to 2.6.92.0 and switch them to application-based authentication this quarter, then move every SMS and voice user to a passkey or a telephony provider you contract yourself.

The sync deadline is the one that hurts quietly. Microsoft says synchronization services will stop working after 7 April 2027 if a server is still on an older version or still using the legacy account. Nothing breaks on screen. Cloud accounts just stop changing, so the first sign is usually a new hire who can't sign in on day one, or a leaver whose mailbox still works.

The SMS change hits people directly. After 1 February, a user whose only MFA method is a Microsoft-sent text or call gets a blocking prompt at sign-in and has to register a passkey before they can carry on. Microsoft's FAQ says nobody gets locked out outright, but a whole office meeting that prompt on the same Monday morning will still reach the helpdesk. Self-service password reset by text is in scope as well, so the password reset flow changes at the same time.

There's a security side to both. A sync account with a password that never expires is a credential worth stealing, and a text message can be intercepted or redirected with a SIM swap. Microsoft gives both reasons for the changes, so this is a chance to close two old gaps on a deadline you'd struggle to argue with.

For engineers: the new sign-in is a single-tenant app registration with a certificate credential. By default Entra Connect creates the app, makes a certificate with a 90-day lifetime and rotates it for you through the sync scheduler. Microsoft recommends a TPM on the server so the private key sits in hardware. Without one, the key goes to the software key storage provider marked non-exportable.

The second item catches people out. Plenty of teams leave auto-upgrade on and assume Microsoft keeps them compliant. Today auto-upgrade stops at 2.6.3.0, below the floor, and even a server upgraded by hand to 2.6.92.0 stays on the old account until someone runs the wizard task. So check the sign-in on every server, not just the version.

Picking the target build is simple once you read the known issues. 2.6.84.0 is the floor Microsoft names, but it can fail to install over an existing ADSync database, and its own support ends on 16 September 2027. 2.6.79.0 was pulled after release, and Microsoft tells anyone who installed it to move to the latest build. Go straight to 2.6.92.0.

Microsoft is ending the texts and calls it sends itself. It isn't banning SMS as a method. You can keep codes going for the people who really need them through Choose Your Own Telephony Provider, which Microsoft calls CYOTdefinitionChoose Your Own Telephony Provider. Your company signs up with a provider in Microsoft Security Store, and Entra keeps sending texts and calls through them after Microsoft stops., and it went live for workforce tenants in global Azure on 30 October. Everyone else should move to a passkey, or at least to an authenticator app.

Turning CYOT on takes more than a tick box. Microsoft hands each request to an endpoint you deploy in your own Azure subscription, and your team keeps that running and renews its credentials. The provider only delivers the messages. So budget for message charges and Azure hosting, and decide who gets paged when codes stop arriving at 2am.

# example: run on each Entra Connect Sync server
Import-Module ADSync
Get-ADSyncEntraConnectorCredential
Get-ADSyncAutoUpgrade -Detail
# example output (illustration, layout varies)
ConnectorIdentityType : ServiceAccount
Suspended  UpgradeNotSupportedNonLocalDbInstall

Read that output as two problems. ServiceAccount means the server still uses the legacy Sync_ login, so it needs the wizard task whatever version it runs. If auto-upgrade is suspended and the detail says UpgradeNotSupportedNonLocalDbInstall, the server runs on full SQL Server and will never upgrade itself. Someone has to do it by hand.

We start with an inventory: every sync server with its version, database and sign-in type, plus every user still enabled for SMS or voice. Then we upgrade staging first, switch each server to application-based authentication and plan the passkey rollout around your helpdesk. Our Microsoft Entra ID page covers the wider hybrid identity work, the identity and access management practice covers MFA and Conditional Access, and you can bring in engineers for the migration itself. If you'd like a second opinion first, ask for an assessment. Teams still moving scripts off user logins can read our guide to Azure mandatory MFA for automation.