The Entra Connect Sync first-party app in Conditional Access and sign-in logs

Connect-MgGraph -Scopes "Application.Read.All", "RoleManagement.Read.Directory"

$syncSp = Get-MgServicePrincipal -Filter "appId eq '6bf85cfa-ac8a-4be5-b5de-425a0d0dc016'"
$syncSp | Select-Object DisplayName, Id, AccountEnabled, AppRoleAssignmentRequired

$roleNames = @{}
$syncSp.AppRoles | ForEach-Object { $roleNames[$_.Id] = $_.Value }

# Principals holding an app role on the sync resource (the Connect applications)
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $syncSp.Id -All |
    Where-Object PrincipalType -eq 'ServicePrincipal' |
    ForEach-Object {
        $sp  = Get-MgServicePrincipal -ServicePrincipalId $_.PrincipalId
        $app = Get-MgApplication -Filter "appId eq '$($sp.AppId)'"
        [pscustomobject]@{
            Principal     = $_.PrincipalDisplayName
            AppRole       = $roleNames[$_.AppRoleId]
            AssignedOn    = $_.CreatedDateTime
            AppCerts      = @($app.KeyCredentials).Count
            AppSecrets    = @($app.PasswordCredentials).Count
            SpCredentials = @($sp.KeyCredentials).Count + @($sp.PasswordCredentials).Count
            Owners        = if ($app) {
                                (Get-MgApplicationOwner -ApplicationId $app.Id |
                                    ForEach-Object { $_.AdditionalProperties.userPrincipalName }) -join '; '
                            } else { '(no app registration in this tenant)' }
        }
    } | Format-Table -AutoSize

# Legacy connector accounts (Directory Synchronization Accounts role)
$dsaRole = Get-MgDirectoryRole | Where-Object RoleTemplateId -eq 'd29b2b05-8046-44ba-8758-1e26182fcf32'
if ($dsaRole) {
    Get-MgDirectoryRoleMember -DirectoryRoleId $dsaRole.Id |
        Select-Object Id, @{ n = 'UserPrincipalName'; e = { $_.AdditionalProperties.userPrincipalName } }
}

AADServicePrincipalSignInLogs
| where TimeGenerated > ago(14d)
| where ResourceIdentity == "6bf85cfa-ac8a-4be5-b5de-425a0d0dc016"
    or ResourceDisplayName == "Microsoft Entra AD Synchronization Service"
| summarize SignIns = count(), LastSeen = max(TimeGenerated), IPs = make_set(IPAddress)
    by ServicePrincipalName, ServicePrincipalId, ServicePrincipalCredentialThumbprint, ResultType, ConditionalAccessStatus

let connectorAccounts = dynamic(["<object id 1>", "<object id 2>"]);
union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(14d)
| where UserId in (connectorAccounts)
| summarize SignIns = count(), LastSeen = max(TimeGenerated)
    by UserPrincipalName, AppDisplayName, ResourceDisplayName, ResourceIdentity, IPAddress, ResultType, ConditionalAccessStatus

(Get-Item 'C:\Program Files\Microsoft Azure AD Connect\AzureADConnect.exe').VersionInfo.ProductVersion
Get-ADSyncEntraConnectorCredential
Get-ADSyncScheduler | Select-Object StagingModeEnabled, SyncCycleEnabled