Azure AD Connect – Automatic Synchronization on User Change

# Azure AD Connect Auto Sync script - Provided as-is, use at own risk.
# Make sure ActiveDirectory module is available on system where script is scheduled.
# Will trigger Azure AD Connect synchronization when on-prem AD user or group is changed.
# Schedule to run every 5 minutes and to start after scheduled start is missed.
# For full info on script and how to schedule it:
# https://www.easy365manager.com/azure-ad-connect-automatic-synchronization-on-user-change
# Configure parameters before scheduling the script:
$AADConnectServer = ""               # Azure AD Connect server (blank assumes local system)
$LogFile = "AD_Azure_Sync_Log.txt"   # Log file used for keeping track of AD changes and troubleshooting
$MaxSize = 5242880                   # Maximum size of log file in bytes (5MB)
$StartTime = Get-Date
While ((New-TimeSpan $StartTime (Get-Date)).Seconds -lt 300) {
  Try {
    Import-Module ActiveDirectory
    If ((Test-Path $LogFile) -eq $False) {
      # Create log file if it doesn't exist
      "Time           Message" | Out-File $LogFile
      "19990101000001 SyncAllChanges" | Out-File $LogFile -Append
    }
    $LastLine = Get-Item -Path $LogFile | Get-Content -Tail 1  # Read last line of log file
    If ((Get-Item $LogFile).Length -gt $MaxSize) {
      # Reset log file if it has grown larger than $MaxSize
      "Time           Message" | Out-File $LogFile
      $LastLine | Out-File $LogFile -Append
    }
    $Now = Get-Date
    $LastSync = [datetime]::parseexact($LastLine.Substring(0, 14), 'yyyyMMddHHmmss', $null) # Get last synchronization time
    [array]$Users = Get-ADUser -Filter 'whenChanged -gt $LastSync'  # Find users that changed since last time
    [array]$Groups = Get-ADGroup -Filter 'whenChanged -gt $LastSync'  # Find groups that changed since last time
    $ChangeCount = $Users.Count + $Groups.Count
    If ($ChangeCount -gt 0) {
      # If any users or groups were changed start the Azure AD Synchronization
      If ($AADConnectServer -ne "" -and $AADConnectServer.ToLower() -ne $env:COMPUTERNAME.ToLower()) {
        # Connect to Azure AD Connect server if not running on local system
        $Session = New-PSSession $AADConnectServer
        $Result = Invoke-Command -Session $Session -Scriptblock {
          Try {
            Import-Module ADSync
            Start-ADSyncSyncCycle -PolicyType Delta
          }
          Catch {
            return $_
          }
        }
        Remove-PSSession $Session
      }
      Else {
        Import-Module ADSync
        Start-ADSyncSyncCycle -PolicyType Delta
      }
      If (!$Result -or $Result.ToString() -eq "Microsoft.IdentityManagement.PowerShell.ObjectModel.SchedulerOperationStatus") {
        $Now.ToString("yyyyMMddHHmmss") + " Synchronized " + $ChangeCount + " Users/Groups." | Out-File $LogFile -Append
      }
      Else {
        "19990101000001 " + ($Result.ToString().Split("`r")[0]) | Out-File $LogFile -Append
      }
    }
    Else {
      $Now.ToString("yyyyMMddHHmmss") + " No changes." | Out-File $LogFile -Append
    }
  }
  Catch {
    "19990101000001 " + ($_.ToString().Split("`r")[0]) | Out-File $LogFile -Append
  }
  Start-Sleep 15
}