Microsoft Entra Connect Disabled

If Microsoft Entra Connect shows as disabled and the agents are not appearing correctly, use this sequence:

1. Check whether an automatic upgrade left Entra Connect in a partial state
   • A known issue on Microsoft Entra Connect 1.1.443.0 or earlier can leave the product only partially upgraded, with the scheduler suspended and no automatic sync cycle.
   • It can also disable password synchronization or password writeback after upgrade.
2. Run the Entra Connect wizard again and select Upgrade
   • After the upgrade finishes, verify that the installed version matches the server configuration.
   • If password sync or password writeback was previously enabled, confirm those features are still enabled.
   • If either feature is now disabled, open the wizard and select Customize synchronization options to enable it manually.
3. Verify local agent services are present and running On the server, open:
   • Start > Run > Services.msc Then confirm these services exist and are Running:
   • Microsoft Entra Connect Agent Updater
   • Microsoft Entra Provisioning Agent
4. If the provisioning agent service fails to start A known cause is group policy preventing permissions from being applied to the local service sign-in account. Fix path:
   • Sign in with an administrator account.
   • Open Services.msc.
   • Double-click Microsoft Entra Provisioning Agent.
   • On the Log On tab, change This account to a domain admin.
   • Restart the service.
5. Check connectivity and proxy configuration If agents are not registering or not reflecting correctly, verify outbound connectivity.
   • Ensure machine.config is correctly configured if a proxy is used.
   • Restart the Microsoft Entra ID Sync service after updating machine.config.
   • Do not rely on changes to miiserver.exe.config, because that file is overwritten during upgrades.
   • Confirm required endpoints are open, including these minimum URLs/ports:
     • mscrl.microsoft.com on HTTP/80
     • *.verisign.com on HTTP/80
     • *.entrust.net on HTTP/80
     • *.management.core.windows.net on HTTPS/443
     • *.graph.windows.net on HTTPS/443
     • secure.aadcdn.microsoftonline-p.com on HTTPS/443
     • graph.microsoft.com on HTTPS/443 for 2.4.18.0 or later
     • *.microsoftonline.com on HTTPS/443
     • certificate validation endpoints such as *.crl3.digicert.com, *.crl4.digicert.com, *.ocsp.digicert.com, *.crl.microsoft.com, and *.oneocsp.microsoft.com on HTTP/80
6. If the Health agent did not upgrade or register correctly There is a documented case where Microsoft Entra Connect Health for Sync did not upgrade correctly and remained unhealthy. In that case, the accepted resolution was to manually install the Microsoft Entra Connect Health for Sync agent and complete authentication with a Global Administrator account so the Azure portal reflected the agent as healthy.
7. Avoid direct registry editing for Entra Connect upgrade troubleshooting Microsoft warns that directly editing the Windows registry for Microsoft Entra Connect upgrade issues is not supported and can cause serious problems if done incorrectly.

If the main symptom is specifically that the agent is missing from the registry/portal after upgrade, the most likely path from the documented issues is:

• rerun Upgrade in the Entra Connect wizard,
• verify services are running,
• verify proxy/connectivity and required URLs,
• then manually reinstall/register the Health for Sync agent if it still does not appear.

References:

• Microsoft Entra Connect is not working correctly after an automatic upgrade
• Troubleshoot Microsoft Entra Connect connectivity issues
• Cloud sync troubleshooting
• Troubleshoot Microsoft Entra Connect upgrade issues
• Entra Connect Sync installation not updating Health Agents - Microsoft Q&A