After being enabled, the synch fails immediately with a single error. Editing and saving the synch configuration could be performed successfully.
The ExchangeSyncEngine log showed a 401 (Unauthorized) error when sending a GET request to http://server/sdata/crmj/crmExchange/-/$service/getSyncEngineConfiguration
This error was returned by IIS. Sending a GET request to the same URL using Fiddler and the X-Sage-Authorization header worked successfully.
Work around / Resolution:
Basic authentication was enabled on the SDATA application in inetmgr. Disabling Basic authentication resolved the issue. Only Anonymous authentication should be enabled on that application.