1. Overview
Once Microsoft Entra Connect Health is deployed, administrators must actively manage and maintain it to ensure consistent monitoring of identity components such as AD FS, AD DS, and Entra Connect Sync.
This unit focuses on:
Think of this as the day-to-day operations layer of Connect Health — it’s how admins keep hybrid identity healthy and auditable after setup.
2. Enabling and Managing Email Notifications
By default, Connect Health can send email alerts when:
These notifications ensure that admins are immediately aware of identity issues without having to log into the portal.
Steps to Enable or Configure Notifications
Note: Notification settings only apply after saving, and you can remove recipients anytime by selecting and deleting their email entry.
Notification Behavior Changes
Microsoft optimized email notifications to reduce noise:
Example: If ten sync errors occur during the day, the admin receives one summary email instead of ten separate ones.
3. Managing and Deleting Servers or Service Instances
Sometimes, monitored servers (e.g., decommissioned AD FS nodes) or service instances (e.g., test environments) must be removed from Connect Health.
Important Considerations Before Deletion
4. Deleting a Server from Connect Health
Steps
This process stops telemetry uploads from that specific machine and removes it from the dashboard.
5. Deleting a Service Instance
A service instance represents a logical group, such as an AD FS farm or Entra Connect configuration. Deleting it removes all monitored servers that belong to that instance from Connect Health.
Steps
Result:
6. Managing Access with Azure Role-Based Access Control (RBAC)
Connect Health integrates with Azure RBAC, which allows you to control who can view or manage health data. This follows the principle of least privilege — granting only the necessary access to specific users or groups.
Built-in Roles
| Role | Permissions |
|---|---|
| Owner | Full control: can manage access, view all data, and modify settings. Global admins are automatically Owners. |
| Contributor | Can view data and change settings (like notifications) but cannot manage access. |
| Reader | Can view dashboards and alerts but cannot modify anything. |
| (All other roles like User Access Administrator or DevTest Labs User have no effect on Connect Health access.) |
7. Access Scope Levels
You can assign roles at two levels:
| Scope Level | Description |
|---|---|
| All Service Instances | Applies to all AD FS farms, AD DS, and sync services being monitored. Recommended for central admins. |
| Specific Service Instance | Restricts access to only one monitored instance (e.g., a regional AD FS farm). Useful for local or delegated administrators. |
If a user has access at either level, they can view the respective instance in the portal.
8. Granting Access in Connect Health
Steps
The user or group appears in the access list immediately.
Note: The Invite Users feature is not supported in Connect Health — users must already exist in your Microsoft Entra tenant.
Example:
Contoso’s IT team has:
9. Sharing and Pinning Dashboards
After granting access, you can help users access the portal more easily:
This is particularly useful for service owners or NOC teams monitoring real-time authentication health.
10. Removing Users or Groups
If a user or group no longer needs access:
This immediately revokes their permissions from Connect Health (though not other Entra services).
11. Diagnosing and Remediating Duplicate Attribute Sync Errors
One of the most powerful management features of Connect Health is self-service diagnostics for synchronization errors, particularly duplicated attributes.
Overview
When you see sync errors like:
Connect Health introduces a diagnose and fix feature that allows admins to detect and repair these errors directly from the portal.
How It Works
Example Scenario
12. Benefits of Self-Service Sync Diagnostics
13. Real-World Example
Scenario: A multinational enterprise merges with another company. During sync setup, several duplicate proxy addresses appear (e.g., alex@contoso.com already exists in alex@fabrikam.com).
Using Connect Health:
Result: What would normally take hours of PowerShell cleanup is resolved from the Connect Health interface.
14. Best Practices for Connect Health Management
| Practice | Reason |
|---|---|
| Assign roles using RBAC instead of global admin access. | Improves security and least privilege control. |
| Enable email notifications and review daily digest alerts. | Prevents missed critical sync or federation issues. |
| Regularly remove stale servers and service instances. | Keeps dashboard clean and accurate. |
| Periodically use diagnostics to fix duplicate sync errors. | Maintains clean identity data and prevents login issues. |
| Ensure agents are updated and reporting successfully. | Avoids data gaps in monitoring. |
15. Exam Tips
16. Summary
Managing Microsoft Entra Connect Health effectively ensures continuous visibility and control over hybrid identity infrastructure. Through alerts, RBAC, and diagnostic automation, administrators can:
By operationalizing Connect Health, organizations maintain a stable, secure, and well-audited hybrid identity environment that aligns with enterprise governance and exam best practices.
✅ Module 3 Complete: Implement and Manage Hybrid Identity You now have detailed understanding of: