AZUREADSSOACC Key Rollover no longer works using Hybrid Identity Administrator creds

Billy 75 Reputation points
2024-04-17T21:34:42.04+00:00

Hi

I use a PowerShell script in an Azure Hybrid Worker Runbook to automate the rollover of the Kerberos decryption key for the AZUREADSSOACC computer account.

It uses a service account in Entra ID which is assigned the Hybrid Identity Administrator role, and a service account in AD assigned Write and Reset password permissions on the computer account.

It has been working fine for a couple of years but failed today with the following error:

Update-AzureADSSOForest: Uploading computer account information failed. Error message: Internal error: An error occurred during the 'DesktopSsoNumOfDomains' process. Contact support (Failed Request Id = 'e2879aa3-ab9e-4093-a624-c2fc0acaa430')
**
After some troubleshooting I have determined the cause to be the Entra ID service account.

The Hybrid Identity Administrator role no longer works, but if I assign the service account the Global Admin role it works as expected.

The following commands complete without error:
New-AzureADSSOAuthenticationContext
Get-AzureADSSOStatus | ConvertFrom-Json
**
I get the same error when running the command locally on the Entra ID Connect server in both PowerShell 5.1 and PowerShell 7.4.1/7.4.2

It makes no difference if I use the AD service account or a Domain Admin account, these both work when the Entra ID service account has the Global Admin role.

User's image

The docs still say we can use an account with the Hybrid Identity Administrator role, but has this changed? It would be a shame to have to go back to using the Global Admin role.

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-faq#how-can-i-roll-over-the-kerberos-decryption-key-of-the--azureadsso--computer-account-

Thanks

Billy

Windows for business | Windows Client for IT Pros | Directory services | Active Directory
Microsoft Security | Microsoft Entra | Microsoft Entra ID
Answer accepted by question author
Givary-MSFT 35,791 Reputation points Microsoft Employee Moderator
2024-04-22T11:32:05.11+00:00

@Billy @Anton Dobschensky @Sander Walraven Thank you for raising this issue on QnA platform, on further investigation found that our team is aware of this issue and working internally to fix the same.

Will track the progress of the issue and will update the status here.

Was this answer helpful?

3 people found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Robert Murphy 0 Reputation points
    2024-12-27T03:49:49.3866667+00:00

    Any update on this fix? Issue is still happening as of 12/26 and none of the workaround found seem to work.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.