Issues with Azure AD Connect Synchronization: Urgent Assistance Needed

Question

I am encountering significant issues with Azure AD Connect synchronization between our on-premises Active Directory and Azure AD. The sync status shows enabled, but the last sync was more than one day ago. Password hash synchronization fails with the following error:

Password hash synchronization health task failed during ping operation. Details:

System.InvalidOperationException: An error occurred, SynchronizationEngineManagedHandle.cpp(190), code 80004005,

BAIL: MMS(15828): ..\PasswordHashSync.cpp(748): 0x80004005 (Unspecified error)

Azure AD Sync 2.3.6.0

at SynchronizationEnginePasswordHashSyncManagedHandle.Ping(String state)

at Microsoft.Online.PasswordSynchronization.Fim.FimNotificationManager.Ping(String forestInfo, TimeSpan interval)

at Microsoft.Online.PasswordSynchronization.RetryUtility.ExecuteWithRetryT

at Microsoft.Online.PasswordSynchronization.HealthTask.SynchronizeCredentialsToCloud()

<forest-info>

<partition-name>INTERN.__________.__</partition-name>

<connector-id>7b9e921d-8ce6-44c3-8442-c02300994cb3</connector-id>

</forest-info>

The server encountered an unexpected error while processing a password change notification:

"AADSTS50079: Due to a configuration change made by your administrator, or because you moved to a new location, you must enroll in multi-factor authentication to access '00000002-0000-0000-c000-000000000000'. Trace ID: 33cf2e6c-2754-4f2d-b5d0-a4ac53192400 Correlation ID: faa03b1a-58b8-4e3e-a265-043cb3789063 Timestamp: 2024-06-03 14:18:02Z

at InitializeAndGetTargetExtension(Object lockObject, TargetTaskScheduler taskScheduler, Dictionary`2 targetExtensions, ECMAInformation* ecmaInformation)

at TargetExtensionManager.Ping(TargetExtensionManager* , ECMAInformation* ecmaInformation, Char* state, Int32* result)

InnerException=>

none

Troubleshooting Steps Taken

• Restarted the Microsoft Entra Connect Sync service.
• Checked the scheduler status and enabled it.
• Performed manual sync operations.
• Reviewed event logs for errors.
• Verified network connectivity and permissions.
• Updated Azure AD Connect to the latest version.
• Reconfigured Azure AD Connect settings.
• Confirmed that the Azure admin account used by Azure AD Connect is excluded from all MFA policies.

Answer 1

Hello Marius,

Thanks for your question.

Please can you go to Azure and search for your directory sync account as MFA may have been enabled on it. The account should be this format.

Exclude account from all CA policies.

https://learn.microsoft.com/en-us/entra/id-governance/conditional-access-exclusion

Please let me know if you have further questions.

If the above information was useful, please remember to 'Accept Answer'