Get-ADSyncAADCompanyFeature requires AADUserName after an Entra Connect upgrade

After migrating Microsoft Entra Connect to a newer version, some PowerShell cmdlets may change behavior before the official documentation fully catches up.

This is the case with Get-ADSyncAADCompanyFeature in Microsoft Entra Connect Sync 2.6.84.0.

Symptom

On an older Entra Connect Sync server running version 2.6.3.0, the following command worked without any parameter:

Get-ADSyncAADCompanyFeature

After migrating to a new server running version 2.6.84.0, the same cmdlet now requires the AADUserName parameter.

Cause

After comparing the ADSync folder (C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync) between some servers, the same 33 files were present, but the binaries were different between builds 2.6.3.0 and 2.6.84.0.

Reflection analysis of Microsoft.IdentityManagement.PowerShell.Cmdlet.dll shows that, in version 2.6.84.0, several cmdlets gained an AADUserName parameter:

• Get-ADSyncAADCompanyFeature
• Set-ADSyncAADCompanyFeature
• Set-ADSyncAADPasswordSyncState
• Set-ADSyncScheduler

This is an intentional Microsoft change.

Cmdlets that read or modify tenant-side Entra ID configuration no longer rely only on the stored credentials of the Sync_* synchronization account. They now require interactive MSAL authentication with a cloud administrator account.

From the 2.6.84.0 release notes:

PowerShell cmdlets that modify cloud configuration (Set-ADSyncAADCompanyFeature, Set-ADSyncAADPasswordSyncState) now require explicit -AADUsername for interactive admin authentication.

Solution

This behavior is expected.

Run the cmdlet by explicitly providing the Entra ID administrator account to use:

Get-ADSyncAADCompanyFeature -AADUserName "[email protected]"

An Entra ID authentication window will open for that account. The account must have the required permissions, for example:

• Hybrid Identity Administrator
• or Global Administrator

The interactive authentication flow supports MFA.

Impact on scripts

This is the important part: if you have administration or monitoring scripts that call these cmdlets without parameters, they must be updated.

In practice, these commands are no longer suitable for fully unattended execution if they trigger an interactive authentication prompt.

One simple way to keep a script compatible with both behaviors is to inspect the cmdlet metadata before calling it:

$companyFeatureCommand = Get-Command -Name 'Get-ADSyncAADCompanyFeature'
$aadUserNameParameter = $companyFeatureCommand.Parameters['AADUserName']
if ($aadUserNameParameter -and ($aadUserNameParameter.Attributes | Where-Object {
    $_ -is [System.Management.Automation.ParameterAttribute] -and $_.Mandatory
})) {
    Write-Host -ForegroundColor Yellow 'Get-ADSyncAADCompanyFeature requires an Entra ID username for interactive authentication (e.g. [email protected]).'
    $aadUserName = Read-Host -Prompt 'AADUserName'
    $adsyncCompanyFeatures = Get-ADSyncAADCompanyFeature -AADUserName $aadUserName
}
else {
    $adsyncCompanyFeatures = Get-ADSyncAADCompanyFeature
}

This avoids relying on the installed Entra Connect version number. The script checks the actual command exposed by the local ADSync module and adapts accordingly.

You should review any script using:

Get-ADSyncAADCompanyFeature
Set-ADSyncAADCompanyFeature
Set-ADSyncAADPasswordSyncState

Watch out for documentation gaps

The official ADSync PowerShell documentation may lag behind the actual module behavior.

At the time of analysis, Get-ADSyncAADCompanyFeature and Set-ADSyncAADCompanyFeature were not documented in the ADSync PowerShell reference.

When in doubt, check the available syntax directly on the server:

Get-Command Get-ADSyncAADCompanyFeature -Syntax

A solution could be to use

$companyFeatureCommand = Get-Command -Name 'Get-ADSyncAADCompanyFeature'

$aadUserNameParameter = $companyFeatureCommand.Parameters['AADUserName']


if ($aadUserNameParameter -and ($aadUserNameParameter.Attributes | Where-Object { $_ -is [System.Management.Automation.ParameterAttribute] -and $_.Mandatory })) {

  Write-Host -ForegroundColor Yellow 'Get-ADSyncAADCompanyFeature requires an Entra ID username for interactive authentication (e.g. [email protected]).'
  
  $aadUserName = Read-Host -Prompt 'AADUserName'
  
  $adsyncCompanyFeatures = Get-ADSyncAADCompanyFeature -AADUserName $aadUserName
}
else {
  $adsyncCompanyFeatures = Get-ADSyncAADCompanyFeature
}