Azure AD connector service account missing role, how do I get it back?

Favian Zendejas 21

We have Azure AD Connect installed on a server. We recently stopped being able to sync due to this error: "Access policy does not allow token
issuance."

We do not have any conditional access policies in place. We noticed our On-Premises Directory Synchronization Service Account is missing the built-in role "Directory synchronization accounts" and it cannot be reassigned. Any ideas where I can go from here or how to get the role back in place?

Accepted answer

Andy David - MVP 145.6K Reputation points MVP

2022-10-31T13:00:00.677+00:00

Can you exclude that service account from the those policies if they are enabled?

As far as I know, its not supported to add that role outside of the AADConnect Wizard:
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions#azure-ad-connector-account

However, you may be able to add it via powershell:
https://github.com/MicrosoftDocs/azure-docs/issues/53899
Please sign in to rate this answer.
Favian Zendejas 21 Reputation points

2022-10-31T13:12:08.743+00:00

Looks like excluding the service account from the policies that were enabled worked! Thank you so much
Sign in to comment

2 additional answers

Andy David - MVP 145.6K Reputation points MVP

2022-10-28T16:07:27.477+00:00

Can you export the config out and reinstall AADConnect using the existing config?

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-import-export-config
Please sign in to rate this answer.
Favian Zendejas 21 Reputation points

2022-10-28T16:13:35.61+00:00

I've tried getting my export data from the AD Connect software, but it requires me to upgrade the version first but that errors out with a similar error as stated above. I seem to be stuck in a loop.

Andy David - MVP 145.6K Reputation points MVP

2022-10-28T16:34:57.747+00:00

Can you export following?
http://www.tbone.se/2020/08/27/azure-ad-connect-export-and-import/

Favian Zendejas 21 Reputation points

2022-10-28T18:27:41.067+00:00

I was able to export the data with the method you provided but I'm still unable to move past the Azure Active Directory Connect upgrade. I still get an "Access policy does not allow token issuance" error!

Andy David - MVP 145.6K Reputation points MVP

2022-10-28T18:37:01.317+00:00

Sounds like you have a Conditional Access Policy or security defaults enabled that is requiring MFA or otherwise blocking the accounts you are using
I would check the Azure Sign In logs
What version are you at? Are you upgrading the to latest?

Favian Zendejas 21 Reputation points

2022-10-28T18:58:23.197+00:00

I see sign in failures but when you run an audit on the service account to confirm what conditional access rule is causing this it shows no rules are applied. I'm running version 2.1.18.0 which I thought was the latest version?

Andy David - MVP 145.6K Reputation points MVP

2022-10-28T19:14:18.76+00:00

Are Security Defaults enabled?

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults

Favian Zendejas 21 Reputation points

2022-10-28T19:21:46.6+00:00

Security Defaults are not enabled

Andy David - MVP 145.6K Reputation points MVP

2022-10-28T19:55:48.493+00:00

So you have no conditional access policies? None at all?

Favian Zendejas 21 Reputation points

2022-10-28T19:59:43.387+00:00

Nope no conditional access policies or classical conditional access policies.

Andy David - MVP 145.6K Reputation points MVP

2022-10-28T20:31:41.85+00:00

Are you enforcing MFA on a per account basis?

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates

This was working until recently?

Favian Zendejas 21 Reputation points

2022-10-31T12:35:10.127+00:00

I do have MFA enabled per user, but the sync service account was disabled. Yeah this was working until we swapped out to a new firewall and a new public IP. The firewall has been ruled out as an issue.
Sign in to comment
Andy David - MVP 145.6K Reputation points MVP

2022-10-31T12:41:26.187+00:00

The change in IP may have tripped a Identity Policy:

Check here to see what is set:
https://portal.azure.com/?feature.msaljs=false#view/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/~/Overview
Please sign in to rate this answer.
Favian Zendejas 21 Reputation points

2022-10-31T12:54:13.627+00:00

I have these policies set to "Low and Above" for all users but no risky sign in or blocks are showing in the logs besides that log ins I've shown before that seem to point to a non-existent policy. Do you know of any way to reassign the "Directory synchronization accounts" role to the sync user? I think the fact that it's missing that role is causing some issues.
Sign in to comment

Share via

Azure AD connector service account missing role, how do I get it back?

2 additional answers