AZUREADSSOACC Key Rollover no longer works using Hybrid Identity Administrator creds

Question

Hi

I use a PowerShell script in an Azure Hybrid Worker Runbook to automate the rollover of the Kerberos decryption key for the AZUREADSSOACC computer account.

It uses a service account in Entra ID which is assigned the Hybrid Identity Administrator role, and a service account in AD assigned Write and Reset password permissions on the computer account.

It has been working fine for a couple of years but failed today with the following error:

Update-AzureADSSOForest: Uploading computer account information failed. Error message: Internal error: An error occurred during the 'DesktopSsoNumOfDomains' process. Contact support (Failed Request Id = 'e2879aa3-ab9e-4093-a624-c2fc0acaa430')
**
After some troubleshooting I have determined the cause to be the Entra ID service account.

The Hybrid Identity Administrator role no longer works, but if I assign the service account the Global Admin role it works as expected.

The following commands complete without error:
New-AzureADSSOAuthenticationContext
Get-AzureADSSOStatus | ConvertFrom-Json
**
I get the same error when running the command locally on the Entra ID Connect server in both PowerShell 5.1 and PowerShell 7.4.1/7.4.2

It makes no difference if I use the AD service account or a Domain Admin account, these both work when the Entra ID service account has the Global Admin role.

The docs still say we can use an account with the Hybrid Identity Administrator role, but has this changed? It would be a shame to have to go back to using the Global Admin role.

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-faq#how-can-i-roll-over-the-kerberos-decryption-key-of-the--azureadsso--computer-account-

Thanks

Billy

Answer 1

@Billy @Anton Dobschensky @Sander Walraven Thank you for raising this issue on QnA platform, on further investigation found that our team is aware of this issue and working internally to fix the same.

Will track the progress of the issue and will update the status here.