AdSyncScheduler Error

Question

hi,

Suddenly not synchronization

Get-ADSyncScheduler

message below ;

Get-ADSyncScheduler : System.InvalidOperationException: There was an issue obtaining cloud sync intervals --->
Microsoft.Identity.Client.MsalUiRequiredException: AADSTS50079: Due to a configuration change made by your
administrator, or because you moved to a new location, you must enroll in multi-factor authentication to access
'00000002-0000-0000-c000-000000000000'.
Trace ID: 9ff7a8e1-de1b-4e79-a9d4-c943d54e6f00
Correlation ID: 45fd7184-9ae0-4087-bed2-f0fc0dc173b9
Timestamp: 2023-03-30 17:32:08Z
   at Microsoft.Online.Deployment.Client.Framework.MSALAuthenticationProvider.AuthenticateMSAL(AzureService
azureService, String userName, SecureString password, Boolean useCachedToken, String& accessToken, String& errorCode,
String& additionalDetails, Boolean throwOnException, Boolean throwExceptionOnMFAError)
   at Microsoft.Online.Deployment.Client.Framework.MSALAuthenticationProvider.AcquireServiceToken(AzureService
azureService, String& serviceEndpoint, String& errorCode, String& additionalDetail, AuthenticationStatus& status,
Boolean throwOnException, Boolean throwExceptionOnMFAError)
   at Microsoft.Online.Deployment.Client.Framework.MSALAuthenticationProvider.AcquireServiceToken(AzureService
azureService, String& serviceEndpoint, String& additionalDetail, AuthenticationStatus& status, Boolean
throwOnException)
   at Microsoft.Online.Deployment.Client.Framework.MSALAuthenticationProvider.AcquireServiceToken(AzureService
azureService, String& additionalDetail, Boolean throwOnException)
   at Microsoft.Online.Coexistence.ProvisionHelper.GetSecurityToken()
   at Microsoft.Azure.ActiveDirectory.Synchronization.ProvisioningWebServiceAdapter.ProvisioningWebServiceAdapter.Initi
alizeProvisionHelper()
   at Microsoft.Azure.ActiveDirectory.Synchronization.ProvisioningWebServiceAdapter.ProvisioningWebServiceAdapter.Initi
alize()
   at Microsoft.Azure.ActiveDirectory.Synchronization.ProvisioningWebServiceAdapter.ProvisioningWebServiceAdapter.GetCo
mpanyConfiguration(Boolean includeLicenseInformation)
   at Microsoft.Azure.ActiveDirectory.Synchronization.AADConfig.get_CloudEnforcedSyncSchedulerInterval()
   at Microsoft.MetadirectoryServices.Scheduler.SchedulerSettingUtilities.get_CurrentSchedulerSettings()
   --- End of inner exception stack trace ---
   at Microsoft.MetadirectoryServices.Scheduler.SchedulerSettingUtilities.get_CurrentSchedulerSettings()
   at SchedulerUtils.GetCurrentSchedulerSettings(SchedulerUtils* , _ConfigAttrNode* pcanList, UInt32 ccanItems, Char**
syncSettingsSerialized, Char** errorString)
At line:1 char:1
+ Get-ADSyncScheduler
+ ~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : WriteError: (Microsoft.Ident...ADSyncScheduler:GetADSyncScheduler) [Get-ADSyncScheduler]
   , InvalidOperationException
    + FullyQualifiedErrorId : System.InvalidOperationException: There was an issue obtaining cloud sync intervals --->
    Microsoft.Identity.Client.MsalUiRequiredException: AADSTS50079: Due to a configuration change made by your admini
  strator, or because you moved to a new location, you must enroll in multi-factor authentication to access '0000000
 2-0000-0000-c000-000000000000'.
Trace ID: 9ff7a8e1-de1b-4e79-a9d4-c943d54e6f00
Correlation ID: 45fd7184-9ae0-4087-bed2-f0fc0dc173b9
Timestamp: 2023-03-30 17:32:08Z
       at Microsoft.Online.Deployment.Client.Framework.MSALAuthenticationProvider.AuthenticateMSAL(AzureService azureS
   ervice, String userName, SecureString password, Boolean useCachedToken, String& accessToken, String& errorCode, St
  ring& additionalDetails, Boolean throwOnException, Boolean throwExceptionOnMFAError)
       at Microsoft.Online.Deployment.Client.Framework.MSALAuthenticationProvider.AcquireServiceToken(AzureService azu
   reService, String& serviceEndpoint, String& errorCode, String& additionalDetail, AuthenticationStatus& status, Boo
  lean throwOnException, Boolean throwExceptionOnMFAError)
       at Microsoft.Online.Deployment.Client.Framework.MSALAuthenticationProvider.AcquireServiceToken(AzureService azu
   reService, String& serviceEndpoint, String& additionalDetail, AuthenticationStatus& status, Boolean throwOnExcepti
  on)
       at Microsoft.Online.Deployment.Client.Framework.MSALAuthenticationProvider.AcquireServiceToken(AzureService azu
   reService, String& additionalDetail, Boolean throwOnException)
   at Microsoft.Online.Coexistence.ProvisionHelper.GetSecurityToken()
       at Microsoft.Azure.ActiveDirectory.Synchronization.ProvisioningWebServiceAdapter.ProvisioningWebServiceAdapter.
   InitializeProvisionHelper()
       at Microsoft.Azure.ActiveDirectory.Synchronization.ProvisioningWebServiceAdapter.ProvisioningWebServiceAdapter.
   Initialize()
       at Microsoft.Azure.ActiveDirectory.Synchronization.ProvisioningWebServiceAdapter.ProvisioningWebServiceAdapter.
   GetCompanyConfiguration(Boolean includeLicenseInformation)
   at Microsoft.Azure.ActiveDirectory.Synchronization.AADConfig.get_CloudEnforcedSyncSchedulerInterval()
   at Microsoft.MetadirectoryServices.Scheduler.SchedulerSettingUtilities.get_CurrentSchedulerSettings()
   --- End of inner exception stack trace ---
   at Microsoft.MetadirectoryServices.Scheduler.SchedulerSettingUtilities.get_CurrentSchedulerSettings()
       at SchedulerUtils.GetCurrentSchedulerSettings(SchedulerUtils* , _ConfigAttrNode* pcanList, UInt32 ccanItems, Ch
   ar** syncSettingsSerialized, Char** errorString),Microsoft.IdentityManagement.PowerShell.Cmdlet.GetADSyncScheduler

Answer 1

That error indicates that the sync account is covered by a Conditional Access policy or MFA setting that is blocking it.

Confirm its excluded from MFA.

Answer 2

We found that a new conditional access rule was deployed that included all users.

This also included the sync user "On-Premises Directory Synchronization Service Account".

Editing the conditional access policy in Entra Admin Center, going to the users section in the policy, and adding this Sync user to the excluded list. Instantly fixed the issue.