Microsoft Entra Connect Sync fails to login

Question

I'm trying to update Microsoft Azure AD Connect from 2.3.20.0 to 2.4.21.0. During the update process when trying to login I'm being redirected to a login window, account credentials are selected, MFA entered correctly - and the login screen changes to Keep your account secure / Update your browser.

The problem is according to Edge it is up to date.

Answer 1

The message is misleading. After fiddling with 2FA it finally worked.

Answer 2

Hello @Marcin Norek,

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue: Microsoft Entra Connect Sync fails to login

Solution: Resolved by @Marcin Norek.

After fiddling with 2FA it finally worked.

If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Thanks,
Raja Pothuraju.

Answer 3

Here are a couple of things that may be the cause of this issue.

1. TLS 1.2 is not configured.

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-tls-enforcement

2. Reboot server
3. Reset all IE zone settings
4. Restore advanced IE settings
5. Turn off IE enhanced security settings
6. Change default browser to IE or Microsoft Edge

If those fail, check Event Viewer.
You may see the following error:
error_description":"AADSTS50079: Due to a configuration change made by your administrator, or because you moved to a new location, you must enroll in multi-factor authentication to access '00000002-0000-0000-c000-000000000000'

This means the account being used needs to be registered with Azure MFA. I tried adding the account to exclusions in "Conditional Access policies" but that did not work, or I failed to give it time to replicate.

Once I went through the registration, I was able to complete the sync between AD and Azure. I still find it stupid that it gives that false error about the browser being unsupported given that Edge and/or Chrome was installed on the server. IE is uninstalled by default in our corp. image of Windows Servers.