Microsoft Entra Connect 2.6.79.0: Apply the Security Fixes Now — Plus FIDO2 Sign-In for the Wizard

Updated 2026-07-13: Microsoft recalled the 2.6.79.0 installer after release and reissued the identical fix set as 2.6.84.0 (07 July 2026) — same security fixes, same FIDO2/passkey wizard preview, same auto-upgrade improvements. If you're still on anything below 2.6.79.0/2.6.84.0, install 2.6.84.0 directly; if you already installed 2.6.79.0, uninstall it and move to 2.6.84.0. Everything else below was reviewed and confirmed current.

Executive Snapshot

TL;DR

• Treat this as a patch-now release. Microsoft labels 2.6.79.0 as containing security fixes and recommends upgrading as soon as possible. Details are not publicly disclosed, so don't wait for a CVE write-up to act.
• FIDO2 is here — but for the wizard, not your users. Admins can now sign in to the Entra Connect setup wizard with passkeys and FIDO2 security keys through Windows Web Account Manager (WAM). It's in preview and only covers wizard authentication.
• Several behavior changes can bite you. Connect no longer silently falls back to the legacy directory-synchronization account, Password Hash Sync (PHS) self-healing is gone, and two cloud cmdlets now require an explicit -AADUsername.
• Auto-upgrade is finally safer. It now merges your miiserver.exe.config customizations instead of overwriting them — closing the loop on the issue that could stop servers in earlier builds.
• Verify the build and your sync health after upgrading. Confirm 2.6.79.0, re-check the PHS flag, and run a delta sync.

Why this release matters

Microsoft Entra Connect is the bridge between your on-premises Active Directory and Microsoft Entra ID. It runs with high privilege on a domain-joined server and writes directly to your tenant — which makes it exactly the kind of component you want fully patched. When the release notes for version 2.6.79.0 open with "This release includes security fixes. We recommend upgrading to this version as soon as possible," that's your cue to plan a short maintenance window this week, not next quarter.

Microsoft hasn't published the specifics. The bug-fix list ends with a single, deliberately vague line — "Fixed multiple security vulnerabilities in bundled third-party dependencies" — and the headline advisory says no more. That's common for sync-engine releases: the fix ships first, disclosure (if any) follows. The practical takeaway is the same either way: upgrade promptly and don't rely on phased auto-upgrade to get there fast enough.

The good news bundled alongside the fixes is genuinely useful — phishing-resistant sign-in for the people who administer Connect.

What's in 2.6.79.0

Security fixes (apply promptly)

The release is explicitly a security release. Beyond the third-party dependency fixes, one audit-related correction stands out: Connect previously logged the service account identity instead of the actual administrator when Synchronization Rule changes were made. If you rely on Connect audit logs for change attribution, that's now accurate.

Phishing-resistant sign-in for the setup wizard (preview)

This is the headline everyone will quote: the Entra Connect setup wizard now supports passkeys and FIDO2 security keys for administrator sign-in, brokered through Windows Web Account Manager (WAM). It's a real, overdue step toward removing passwords from privileged identity infrastructure.

Read the scope carefully, though:

• It applies to the administrator signing in to the wizard while installing or configuring Connect.
• It does not change how your synced users authenticate, and it is not about syncing FIDO2/passkey credentials to the cloud.
• It's in preview, so validate it in a lab before you depend on it for production change windows.

For a server that holds the keys to your hybrid identity, letting admins authenticate with a FIDO2 key instead of a reusable password is a meaningful reduction in attack surface — it just isn't a user-facing feature.

Operational changes you must not miss

These are the quiet items that cause post-upgrade surprises:

• No more silent fallback to the legacy directory-synchronization account. If Application-Based Authentication setup fails, the wizard now stops with an error instead of quietly reverting: "Microsoft Entra Connect could not configure application-based authentication for this server. Setup cannot continue." Better security posture, but it means a failed ABA config is now a hard stop you must resolve.
• Existing servers are no longer auto-switched to Application-Based Authentication during background sync. New installs still configure ABA at setup. To move an existing server, run the wizard and choose Configure application-based authentication to Microsoft Entra ID.
• PHS self-healing is removed. Password Hash Sync no longer re-enables its own cloud feature flag in the background. If that flag is off, an administrator must turn it back on explicitly — so confirm PHS state after upgrading.
• Two cloud cmdlets now require interactive admin auth. Set-ADSyncAADCompanyFeature and Set-ADSyncAADPasswordSyncState now need an explicit -AADUsername; the wizard uses interactive MSAL auth for cloud writes instead of stored service credentials. The uninstall wizard also now prompts for admin credentials to clean up cloud configuration.
• Auto-upgrade preserves your config edits. It now merges customer modifications to miiserver.exe.config and validates the result before applying, instead of overwriting them. This directly addresses the earlier issue (hotfixed in 2.6.3.0) where auto-upgrade could stop a server that had hand-edited config files.

Bug fixes worth knowing

• TPM-backed certificate handling for Application-Based Authentication is more robust, with a software-certificate fallback when a non-conforming TPM can't produce a valid signature.
• Fixes for the PowerShell diagnostic HTML report, Synchronization Service Manager metaverse search, and Generic SQL (GSQL) connector profile creation.
• France and China sovereign-cloud resolution fixes (Pass-through Authentication registration and cloud-instance detection).

Platform and runtime updates

• Bundled MSAL updated from 4.64.1 to 4.83.3.
• Bundled SQL LocalDB upgraded from SQL Server 2019 to SQL Server 2022.
• Visual C++ redistributable moved to 14.42.34438 (2015–2022); the legacy VC++ 2013 dependency is removed.

The 2.6.79.0 recall — install 2.6.84.0 instead

Shortly after this article originally published, Microsoft identified an issue with the 2.6.79.0 installer and pulled it from the Entra admin center. It has been replaced by 2.6.84.0, released 07 July 2026. The version history now documents 2.6.79.0 with a single line: it's no longer available for download, and anyone who installed it should uninstall and move to 2.6.84.0.

The substance of this article is otherwise unaffected — 2.6.84.0's changelog is the same fix set described above (the third-party dependency security fixes, the audit-logging correction, FIDO2/passkey wizard sign-in preview, the legacy-account/PHS/-AADUsername behavior changes, and the config-merge improvement to auto-upgrade), just shipped under a corrected build number. Everywhere this article says "2.6.79.0," read it as "2.6.79.0, superseded by 2.6.84.0" — the guidance, cmdlets, and pitfalls apply unchanged to 2.6.84.0.

Also worth knowing: Microsoft's mandatory-upgrade deadline is unchanged and separate from this recall — all Entra Connect Sync services stop working 30 September 2026 for anyone below version 2.5.79.0. That's a much older floor than 2.6.x; if you're current enough to care about FIDO2 wizard sign-in, you're already well clear of that deadline. It only matters if you're on a much older, long-neglected install.

Prerequisites

• A supported Windows Server with the Entra Connect Sync role, domain-joined, with outbound HTTPS to Entra ID.
• Global Administrator (or Hybrid Identity Administrator) credentials for the cloud configuration steps.
• A backup of the server (or at least an export of your sync rules and a copy of any customized *.config files) before you start.

How to upgrade safely

For a security release, the recommended path is a prompt manual in-place upgrade rather than waiting for phased auto-upgrade.

# 1) Check the installed Entra Connect Sync build (run on the Connect server)
(Get-Item "C:\Program Files\Microsoft Azure AD Sync\Bin\miiserver.exe").VersionInfo.FileVersion
# Anything below 2.6.84.0 is in scope for this update (2.6.79.0 was recalled — target 2.6.84.0).

Then download 2.6.84.0 from the Microsoft Entra admin center and run the installer — if you already installed the recalled 2.6.79.0, uninstall it first. If you operate a staging server, upgrade it first, validate, then promote. The flow:

flowchart TD
  A[Check current build
miiserver.exe version] --> B{Below 2.6.84.0?}
  B -- No --> Z[Already current — verify sync health]
  B -- Yes --> C[Download 2.6.84.0
from Entra admin center]
  C --> D[Back up server and export config files]
  D --> E{Have a staging server?}
  E -- Yes --> G[Upgrade staging first, validate, promote]
  E -- No --> F[Schedule a short maintenance window]
  G --> H[Run in-place upgrade]
  F --> H
  H --> I[Verify build = 2.6.84.0]
  I --> J[Re-check PHS flag and run a delta sync]

After the installer finishes, confirm the engine is healthy and not stuck in staging mode, then kick a delta sync:

# 2) Verify scheduler/sync state after the upgrade
Get-ADSyncScheduler | Format-List SyncCycleEnabled, StagingModeEnabled, NextSyncCyclePolicyType

# 3) Run a delta sync to confirm the engine works post-upgrade
Start-ADSyncSyncCycle -PolicyType Delta

After you upgrade: re-check PHS and the new cmdlet behavior

Because PHS self-healing is gone, explicitly confirm Password Hash Sync is enabled if you depend on it — and note the cmdlets now expect -AADUsername:

# Cloud-config cmdlets now require interactive admin auth (MSAL) via -AADUsername.
# Stored service credentials are no longer used for these cloud writes.
Set-ADSyncAADCompanyFeature -AADUsername "admin@contoso.onmicrosoft.com" -PasswordHashSync $true

# (If you manage PHS state directly, the same -AADUsername requirement applies.)
Set-ADSyncAADPasswordSyncState -AADUsername "admin@contoso.onmicrosoft.com" -Enable $true

Run these interactively — the wizard and these cmdlets now broker cloud writes through interactive sign-in, which is also where the new passkey/FIDO2 option appears.

Pitfalls to avoid

• Don't assume auto-upgrade will deliver a security fix in time. Phased rollouts can take days. Pull the build and upgrade on your schedule.
• Don't ignore a hard ABA error. The wizard no longer falls back to the legacy account — a failed Application-Based Authentication setup will now block you until resolved.
• Don't forget PHS. With self-healing removed, a disabled PHS flag stays disabled. Verify it after upgrading.
• Don't script the cloud cmdlets headlessly. They now require -AADUsername and interactive auth; unattended automation that relied on stored credentials will break.
• Don't skip the config backup. Even with the improved merge logic, back up customized *.config files before any in-place upgrade.
• Don't install 2.6.79.0 if you're starting fresh. It was recalled after release — go straight for 2.6.84.0, which carries the same fix set under a corrected build.

Key Takeaways

• 2.6.79.0/2.6.84.0 is a security release — upgrade promptly and don't wait for phased auto-upgrade. (2.6.79.0 was recalled post-release; 2.6.84.0 is the version to install.)
• FIDO2/passkey sign-in is a welcome, phishing-resistant option for the setup wizard only, and it's in preview.
• Watch the legacy account, PHS self-healing, and -AADUsername changes — they alter day-to-day operations.
• Verify the build (2.6.84.0), confirm PHS, and run a delta sync after upgrading.
• Auto-upgrade is now safer because it preserves your config customizations.

Next Steps

• Review your Connect server's current build and schedule the upgrade this week.
• Pilot the passkey/FIDO2 wizard sign-in in a lab before relying on it in production change windows.
• Re-validate your hybrid identity hardening baseline after the upgrade.

Related Articles

• Microsoft Entra Tenant Security Hardening: The 2026 Checklist
• Azure AD Conditional Access Policies: Complete Guide
• Zero Trust Network Architecture: A Practical Azure Implementation Guide

Source

Release details from Microsoft's official version history: Microsoft Entra Connect: Version release history — 2.6.79.0. Update: 2.6.79.0 was subsequently recalled and reissued as 2.6.84.0 (07 July 2026), same page.