The account which you use to connect to AD( entering while establishing the connection with AD), It must have Replicate Directory Changes permission on the domain with which you’ll synchronize. 

> The Replicate Directory Changes permission allows an account to query
> for the changes in the directory. This permission does not allow an
> account to make any changes in the directory.

[Grant Active Directory Domain Services permissions for profile synchronization in SharePoint Server 2013][1]


  [1]: https://technet.microsoft.com/en-us/library/hh296982.aspx?f=255&MSPPError=-2147217396