AAD Connect (1.1.524.0 and above) and mS-DS-ConsistencyGuid Permissions

Starting from AAD Connect 1.1.524.0 (May 2017) and above, the tool will automatically configure itself to use mS-DS-ConsistencyGuid as the sourceAnchor.

There are a few gaps in the official documentation (https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-design-concepts#using-msds-consistencyguid-as-sourceanchor) and some blog posts out there:

1. The correct attribute is mS-DS-ConsistencyGuid. Microsoft's official documentation is consistently having the typo "mSDS-ConsistencyGuid" - with the missing dash,
2. You will need to delegate your custom service account to READ + WRITE to mS-DS-ConsistencyGuid. May documentation mentions WRITE but that is not sufficient,
3. You may not be able to use AD Users and Computers to make the permission changes, depending on the operating system version of your domain controller.

The script that worked for me is:

$accountName = "domain\aad_account" #[this is the account that will be used by Azure AD Connect Sync to manage objects in the directory, this is an account in the form of AAD_number].

$ForestDN = "DC=domain,DC=com"

$cmd = "dsacls '$ForestDN' /I:S /G '`"$accountName`":RPWP;ms-ds-consistencyGuid;user'"

Invoke-Expression $cmd

Fix: Note the "RPWP" permissions. RP means read permission, and WP means write permission. Both are required for this feature to work, or else you will be met with the dreaded sync error messages in AAD Connect.