Microsoft Entra Cloud Sync Monitoring

Community MKP for monitoring Microsoft Entra Cloud Sync with Checkmk.

The package provides a special agent that uses the Microsoft Graph API to monitor Cloud Sync job health and provisioning activity.

What you get

• Cloud Sync job and schedule state
• Execution status, freshness and duration
• Successive failures and quarantine detection
• Synchronized object counts
• Provisioning failures and warnings
• Automatic recovery handling for resolved provisioning errors
• Dropped/deprovisioned object monitoring
• Property synchronization activity
• Configurable thresholds through Checkmk rules
• Optional Windows local checks for Cloud Sync agent version and connectivity

Requirements

• Checkmk 2.5

• Microsoft Entra application registration

• Microsoft Graph application permissions:

  • Synchronization.Read.All
  • AuditLog.Read.All
  • Directory.Read.All

• Outbound HTTPS access from the Checkmk server to Microsoft Graph and Microsoft identity endpoints

No additional Python packages or PowerShell modules are required.

Installation

Install the MKP using mkp add / mkp enable, or via Setup > Extension packages.

After installation, configure the special-agent rule:

Microsoft Entra Cloud Sync

Credentials can be stored in the Checkmk password store.

The optional Windows local checks can be deployed on the server running the Microsoft Entra Cloud Sync provisioning agent.