New employees cannot sign in to Microsoft 365, and changed passwords are not taken into account

The MasterLinux agency in Fez synchronizes its Active Directory masterlinux.lab with MasterLinux's Microsoft Entra ID tenant using Entra Connect Sync (password hash synchronization). Last Tuesday (13 October), the infrastructure team replaced the old synchronization server ml-sync-01 (Windows Server 2016, end of support) with ml-sync-02 (Windows Server 2022, Entra Connect 2.4); once ml-sync-02 was configured, ml-sync-01 was shut down, then decommissioned on Thursday.

Since then:

• the four new employees who arrived on Monday (accounts compta04, support07, support08, rh03) cannot open Teams or their mailbox: “This username may be incorrect”;
• employees who changed their Windows password (90-day expiry) must still type the old one for Outlook on the web;
• an employee who left on Friday still has access to their mailbox from their personal phone.

The support team has received 23 tickets since yesterday. You are the on-call administrator, logged on in PowerShell (administrator) on ml-sync-02; the ADSync, ActiveDirectory and Microsoft.Graph modules are installed.