What’s the issue?
Always On Availability Group replicas communicate with each other through a TCP database mirroring endpoint, typically named Hadr_endpoint and listening on port 5022 by default. Each replica connects to its partners through these endpoints to stream transaction log records, exchange health information, and coordinate synchronization.
For these connections to succeed, the SQL Server service account of each replica must have CONNECT permission on the endpoints of the partner replicas. The permission is granted at the endpoint level using GRANT CONNECT ON ENDPOINT::[Hadr_endpoint] TO [DOMAIN\ServiceAccount];, and it must be in place in both directions for full bidirectional communication.
This finding identifies AG configurations where the SQL Server service account has not been granted CONNECT permission on the AG endpoint. The condition is detected by comparing the service accounts of the participating replicas against the permissions recorded in sys.server_permissions for the endpoint.
Why is this a problem?
Without CONNECT permission on the database mirroring endpoint, the service account cannot establish the connections between replicas that keep the availability group synchronized. The endpoint may be started and listening, and the network may be perfectly healthy, but the connection attempt fails at the authorization step.
The resulting symptoms look like a network or endpoint failure, which makes the actual cause harder to diagnose. Replicas show as disconnected, synchronization does not occur, the primary’s transaction log grows because records cannot be delivered, and failover is not possible to the affected replica. Teams often spend significant time investigating firewall rules and network paths before checking endpoint permissions.
The condition most often appears after a service account change, since the permission is granted to a specific account and does not follow a change to a new one. It can also result from an AG being configured manually without the permission step, or from an endpoint being dropped and recreated without the grants being reapplied.
What should you do about this?
Identify the service account of each replica through SQL Server Configuration Manager or sys.dm_server_services, and review the current endpoint permissions on each replica by querying sys.server_permissions joined to sys.server_principals and sys.endpoints.
Grant the missing permission on each affected replica using GRANT CONNECT ON ENDPOINT::[Hadr_endpoint] TO [DOMAIN\ServiceAccount];, substituting the actual endpoint name and the service account of each partner replica. The grant takes effect immediately, and synchronization typically resumes without further intervention once connections can be established.
Add the endpoint permission step to your service account change procedures, since this is the most common way the permission gets lost. Document the endpoint name, the service accounts, and the granted permissions as part of your AG documentation, and add endpoint permission verification to your standard AG health check so future gaps are detected before they cause synchronization failures.