Hunt MSOL Azure AD Connect / Entra Sync servers
Hunt MSOL Azure AD Connect Or Entra Sync Servers
Query
DeviceTvmSoftwareInventory
| where SoftwareVendor == "microsoft"
| where SoftwareName in ("microsoft_entra_connect_sync", "microsoft_azure_ad_connect")
| distinct DeviceName, SoftwareName, SoftwareVendor, SoftwareVersion
| extend MSOnlineDepricationSafe = iff(
parse_version(SoftwareVersion) < parse_version("2.4.18.0"),
"No",
"Yes"
)About this query
Explanation
This query is designed to identify Microsoft Entra Connect or Azure AD Connect servers that are running versions lower than 2.4.18.0. This is important because, starting from April 30, 2025, Microsoft requires these servers to be at least version 2.4.18.0 to ensure compatibility and security.
Here's a simple breakdown of what the query does:
-
Data Source: It looks at the
DeviceTvmSoftwareInventorytable, which contains information about software installed on devices. -
Filter by Vendor: It filters the data to only include software from Microsoft.
-
Filter by Software Name: It further narrows down the results to only include entries for "microsoft_entra_connect_sync" and "microsoft_azure_ad_connect".
-
Select Unique Entries: It selects distinct combinations of device name, software name, vendor, and version to avoid duplicate entries.
-
Check Version Compliance: It adds a new column called
MSOnlineDepricationSafeto indicate whether the software version is compliant with the upcoming requirement. If the version is below 2.4.18.0, it marks it as "No" (not safe), otherwise "Yes" (safe).
This query helps organizations identify which of their servers need to be updated to meet Microsoft's future requirements.
Details
Robbe Van den Daele
Released: June 12, 2025
Tables
Keywords
Operators