This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(41.6, 79%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAZ%3C/text%3E%3C/svg%3E)
hi,
i am facing an issue with Microsoft entra connect sync . i am getting an error permission issue for msDS-keycredntial link. how to sort out the issue
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
@Abdul Ziyad, UAE Could you help me with the changes performed in your environment due to which this issue occurred ? for example are you in the process of migration from old AADconnect server to new AADconnect server ?
Do you have Active/Staging setup for your Azure AD Connect.
Would recommend to run a full import / full sync cycle on the active server. This will see this server import the changes and then update the devices "msDS-KeyCredentialLink" value in Active Directory.
Let me know if this helps, feel free to post back.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 80%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETB%3C/text%3E%3C/svg%3E)
Hi @Abdul Ziyad, UAE
Device write-back is used to update the msDS-KeyCredentialLink attribute on the computer object from Entra ID as mentioned in the link below:
Device registration and device write-back
Did you check if the service account used on domain connector has read and write permission on this attribut msDS-KeyCredentialLink ?
Please don't forget to accept helpful answer
I invite you to take a look on this article talking about about another permission should be checked to allow writeback through the service account :
The writeback checkbox is still disabled
Please don't forget to accept helpful answer
Hi @themeur-Bourbita
Yes.service account having read write permission for msds-keycrednetial link
@Abdul Ziyad, UAE Just wanted to check, does the issue still persists, if yes help me with the environment details like version of AD Connect & Version of OS of the domain controller to help understand the issue better.
hi thanks. its sorted
@Abdul Ziyad, UAE Thanks for the update.