E_MMS_SCHEMA_NO_CLASSES

Question

Entra connect error: E_MMS_SCHEMA_NO_CLASSES when trying to upgrade

Answer 1

Hello @Adrian Funk,

Thank you for posting your query on Microsoft Q&A.

I understand that you are getting the error: E_MMS_SCHEMA_NO_CLASSES when trying to upgrade Microsoft Entra Connect.

Basically this error will occur due to multiple reasons. One of the reason is that the Multifactor Authentication(MFA) has been enabled for the affected user who is trying to upgrade the Microsoft Entra Connect.

Please check if the Multifactor Authentication(MFA) has been enabled for the affected user who is trying to upgrade the Microsoft Entra Connect by following the below steps.

Below are the different sources of MFA.

1.Per-User MFA.

2.Conditional Access policies.

3.Security Defaults.

4.Identity Protection(MFA registration policy).

1.Per-User MFA

Please check if the Per-User MFA is enabled or not for the user by following the below mentioned steps.

View the status for a user

The per-user MFA administration experience in the Microsoft Entra admin center is recently improved. To view and manage user states, complete the following steps:

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Browse to Identity > Users > All users.
3. Select a user account, and then select Per-user MFA.
4. Please refer to the below Screenshot for your reference.

Search for the affected user and check the Per-user MFA status. If it is enabled, please select Disable MFA as shown in the below Screenshot for your reference.

2.Conditional Access policies

You can verify whether any CA policy is getting applied to complete MFA by following the below mentioned steps.

To view the sign-in logs from the Microsoft Entra admin center:

1. Sign in to the Microsoft Entra admin center as at least a Reports Reader.
2. Go to Users -> All Users -> Select the affected user and select Sign-in logs and check for the sign ins where the Authentication requirement is showing as Multifactor Authentication. Please refer to the below Screenshot for your reference.

3.If any of the sign ins where the Authentication requirement is showing as Multifactor Authentication, please select that sign in and navigate to Conditional Access tab to check which CA is policy is getting applied for that sign in. Please refer to the below Screenshot for your reference.

3. Security Defaults

Please note that if there is no CA policy enabled in your tenant, then please check if the Security Defaults is enabled in your tenant by following the below mentioned steps.

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Browse to Identity > Overview > Properties.
3. Select Manage security defaults.
4. Check if Security Defaults is enabled or not.

Please note that this Security Defaults is tenant wide settings and it will be applicable to all the users in your tenant.

If Security Defaults is enabled in your tenant, then all the users in your tenant are getting MFA through Security Defaults.

For additional details, please refer to the below document for your reference.

Providing a default level of security in Microsoft Entra ID - Microsoft Entra | Microsoft Learn

4.Identity Protection(Multifactor Authentication Registration policy)

Please check if you have enabled Multi factor Authentication Registration policy from Identity Protection by following the below mentioned steps.

1. Sign in to the Microsoft Entra admin center as at least a Security Administrator.
2. Browse to Protection > Identity Protection > Multifactor authentication registration policy.
3. Please check whether the affected user is part of that policy and also check whether the policy is enabled or not from Policy enforcement section.

For additional details, please refer to the below document for your reference.

Configure the MFA registration policy - Microsoft Entra ID Protection | Microsoft Learn

Also, this error can occur if TLS 1.2 is not enabled on your Microsoft Entra connect server

In the recent releases of Microsoft Entra connect the communication happens via TLS 1.2. Please make sure TLS 1.2 is enabled in your Entra connect server.

Please refer to the below document to get the PowerShell script to check if the TLS 1.2 is enabled and the PowerShell script to enable TLS 1.2 on your Microsoft Entra connect server.

Microsoft Entra Connect: TLS 1.2 enforcement for Microsoft Entra Connect - Microsoft Entra ID | Microsoft Learn

Also please try to refresh the Microsoft Entra Connect schema by following the below mentioned steps.

• Open Synchronization Service Manager on the Microsoft Entra Connect Server.
• Navigate to “Connectors”
• Select the connector named after your On-Premises Active Directory.
• Start action “Refresh Schema”

Please refer to the below Screenshot for your reference.

For more information regarding the upgrading of Microsoft Entra Connect from previous version to the latest version, please refer to the below document for your reference.

Microsoft Entra Connect: Upgrade from a previous version - Microsoft Entra ID | Microsoft Learn

I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".