If you enable conditional access policies and use the default settings, you may find that Azure AD Connector application stops synchronising password changes and Active Directory changes.  This is due to the default condition policy which enforces MFA for all users. As the MSOL user that is used by the Azure AD Connect application is a standard Domain User, it will be required to Multifactor Authenticate by the conditional policies, and fail.

By adding the MSOL user account to the ‘Require MFA for Internal users (admins not included) – Basic’ conditional policy, this will resolve the issue and the Azure AD Connect Application will resume synchronising your on-premise AD and passwords.

Logon to the Microsoft Entra Admin Center, https://entra.microsoft.com (formerly Azure Admin Center)

Select ‘Protection’ in the left hand pane and ‘Conditional Access’.

Select ‘Policies’ and in the right hand pane select ‘Require MFA for internal users (admins not included) – Basic’

Under assignments select ‘All users included and specific users excluded’, in the right-hand pane select ‘Exclude’ and add the On-Premises Directory Sync account.

Save the policy.

Restart the Azure AD connector, and check that the synchronisation now passes.