Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
24,284 questions
Entra Connect Sync unable to create sync service account
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 50%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELR%3C/text%3E%3C/svg%3E)
Liam Ray
0
Reputation points
I am in the process of building a new AD domain environment for my employer. The goal is to have SSO enabled on our domain. When going through the configuration for Entra Connect Sync I can get almost to the end of the wizard when I am given the error "Unable to create the sync service account". However, when I look in the Entra Admin Center I am able to see the user created for my domain. Could this issue be caused by me making a new local domain? I have an alternate upn suffix configured.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(0, 17%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVJ%3C/text%3E%3C/svg%3E)
Venkata Jagadeep 1,080 Reputation points Microsoft External Staff2025-04-02T02:02:56.9+00:00 Hello Liam Ray,
If you are seeing the error "Unable to create the synchronization service account", the most common root cause would be a Conditional Access/MFA policy which requests registration of your connector account user. To resolve this, you can exclude this user from Conditional Access/MFA policies.
Other possible things to check:
Make sure you check the legacy per-user MFA settings in the Admin Portal as well through the direct link to the relevant portal here. Alternatively, you can navigate to Entra ID portal - All Users - Per-User MFA. If MFA is set to enabled, the account will be blocked from signing in and you will need to set it to "Disabled." Then restart the wizard.
To isolate the issue, login with an admin account > check sign-in logs under Monitoring > check the user sign-in logs and non-interactive log to review the failure. You can either remove the service account from any blocking policies or exclude your IP range from the policies.
Ensure that TLS 1.2 is enabled to allow successful authentication.
And if you still face an issue after excluding the account, I suggest you to share the log file (which you have shared in the screenshot) in the private chat.
-
Venkata Jagadeep 1,080 Reputation points Microsoft External Staff
2025-04-03T02:34:59.34+00:00 Hello Liam Ray,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
-
Venkata Jagadeep 1,080 Reputation points Microsoft External Staff
2025-04-04T10:53:39.4333333+00:00 Hello Liam Ray,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Sign in to comment
Sign in to answer