> ## Documentation Index
> Fetch the complete documentation index at: https://ps365.clidsys.com/llms.txt
> Use this file to discover all available pages before exploring further.

> Reports the identities that can synchronize Active Directory to Entra ID: the Connect Sync applications and the legacy synchronization accounts.

# Get-MgDirectorySyncInfo

# Get-MgDirectorySyncInfo

## SYNOPSIS

Reports the identities that can synchronize Active Directory to Entra ID: the Connect Sync applications and the legacy synchronization accounts.

## SYNTAX

```powershell theme={null}
Get-MgDirectorySyncInfo [[-DaysUntilExpiry] <int>] [[-StaleAfterDays] <int>]
 [[-ExportPath] <string>] [-ForceNewToken] [-ExportToExcel]
```

## DESCRIPTION

Microsoft Entra Connect Sync used to authenticate with a directory synchronization account, the Sync\_\<server>\_\<id>
user holding the Directory Synchronization Accounts role.
It now authenticates with an application identity: a
certificate on an application that carries the ADSynchronization.ReadWrite.All application role on the first-party
Microsoft Entra AD Synchronization Service (AppId 6bf85cfa-ac8a-4be5-b5de-425a0d0dc016).

Moving to the application does not remove the account.
Microsoft documents that removal as a separate manual step,
so a tenant that has migrated usually still carries the old account, still in a privileged role, used by nobody.

This function reports both mechanisms in one list, because it is their coexistence that has to be read:

* which application actually synchronizes today, and when its certificate expires.
  An expired certificate stops
  synchronization entirely, so this is an availability matter as much as a security one;
* which synchronization accounts remain, and whether they still sign in.
  An account that has not signed in since
  the migration is the leftover to remove.

A tenant is limited to 20 synchronization accounts, and leftovers count against that limit.

## EXAMPLES

### EXAMPLE 1

```powershell theme={null}
Get-MgDirectorySyncInfo
```

Lists the synchronization applications and the synchronization accounts, with their status.

### EXAMPLE 2

```powershell theme={null}
Get-MgDirectorySyncInfo -DaysUntilExpiry 60
```

Widens the certificate warning to 60 days, to catch the next rollover before the maintenance window closes.

### EXAMPLE 3

```powershell theme={null}
Get-MgDirectorySyncInfo -ExportToExcel
```

Exports the report to an Excel file in the user's profile directory.

## PARAMETERS

### -DaysUntilExpiry

Number of days below which a certificate is reported as expiring.
Default 30.

```yaml theme={null}
Type: System.Int32
DefaultValue: 30
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 0
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''
```

### -ExportPath

Optional output directory for the Excel export.
Defaults to the user profile.

```yaml theme={null}
Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 2
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''
```

### -ExportToExcel

Exports the result to an Excel file in the user's profile directory instead of returning it.

```yaml theme={null}
Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''
```

### -ForceNewToken

Forces a new token to be requested from Microsoft Graph.

```yaml theme={null}
Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''
```

### -StaleAfterDays

Number of days without a sign-in above which a synchronization account is reported as stale.
Default 30.

```yaml theme={null}
Type: System.Int32
DefaultValue: 30
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 1
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''
```

### CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
[about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216).

## INPUTS

## OUTPUTS

## NOTES

Required Microsoft Graph permissions:

* Application.Read.All
* Directory.Read.All

Optional:

* AuditLog.Read.All

AuditLog.Read.All is only needed for the last sign-in of the synchronization accounts, so it is requested but not
required.
Without it the accounts are still listed, with the Unknown status rather than presented as stale: an
account that cannot be shown to be idle must not be offered for deletion.

## RELATED LINKS

* [https://learn.microsoft.com/entra/identity/hybrid/connect/authenticate-application-id](https://learn.microsoft.com/entra/identity/hybrid/connect/authenticate-application-id)
* [https://ps365.clidsys.com/docs/commands/Get-MgDirectorySyncInfo](https://ps365.clidsys.com/docs/commands/Get-MgDirectorySyncInfo)