Upgraded ADConnect to version 2.5.3.0, now error "ApplicationManagedBy is not set correctly" appears when launching the ADConnect configuration wizard

Question

I really need help with this - cannot find any way to fix it. In my test environment, I upgraded ADConnect from 2.4.131.0 to the newest version of Azure ADConnect 2.5.3.0 which includes the option to create an application in Azure to do token based authentication rather than a service account. The installation went fine, the application was created, it appears to be correct, and sync is still occuring but when I launch the ADConnect configuration wizard, I get an error and can't do any configuration tasks. The error is long and contains a stack trace, but it looks like the error says "ApplicationManagedBy is not set correctly". When I run Get-ADSyncEntraConnectorCredential, I see the same error message. When I run (Get-ADSyncGlobalSettings).Parameters | Select Name,Value | Sort Name, the property Microsoft.AADConnector.ApplicationManagedBy is set to EntraConnectSync. So that appears to be correct, although I can't find any documentation that says what it should be set to. Here is the entire contents of that command. I need help fixing the error or some advice on how to back this version out.

Thank you!

Name Value

---

Microsoft.AADConnector.ApplicationManagedBy EntraConnectSync

Microsoft.AADConnector.CredentialManagedBy EntraConnectSync

Microsoft.AADConnector.IdentityType Application

Microsoft.AADFilter.ApplicationList

Microsoft.AADFilter.AttributeExclusionList

Microsoft.Configuration.ImportDate 2023-10-09 14:24:42Z

Microsoft.ConnectDirectories.WizardDirectoryMode ActiveDirectory

Microsoft.DeviceWriteBack.Container

Microsoft.DeviceWriteBack.Forest

Microsoft.DirectoryExtension.SourceTargetAttributesMap

Microsoft.OptionalFeature.AutoUpgradeState Suspended

Microsoft.OptionalFeature.AutoUpgradeSuspensionReason UpgradeNotSupportedNonLocalDbInstall

Microsoft.OptionalFeature.DeviceWriteBack False

Microsoft.OptionalFeature.DeviceWriteUp True

Microsoft.OptionalFeature.DirectoryExtension False

Microsoft.OptionalFeature.DirectoryExtensionAttributes

Microsoft.OptionalFeature.ExchangeMailPublicFolder False

Microsoft.OptionalFeature.ExportDeletionThreshold True

Microsoft.OptionalFeature.ExportDeletionThresholdValue 500

Microsoft.OptionalFeature.FilterAAD False

Microsoft.OptionalFeature.GroupFiltering False

Microsoft.OptionalFeature.GroupWriteBack False

Microsoft.OptionalFeature.HybridExchange False

Microsoft.OptionalFeature.UserWriteBack False

Microsoft.SynchronizationOption.AnchorAttribute mS-DS-ConsistencyGuid

Microsoft.SynchronizationOption.CustomAttribute

Microsoft.SynchronizationOption.JoinCriteria AlwaysProvision

Microsoft.SynchronizationOption.UPNAttribute userPrincipalName

Microsoft.Synchronize.MaintenanceEnabled True

Microsoft.Synchronize.NextStartTime Fri, 27 Jun 2025 13:08:28 GMT

Microsoft.Synchronize.RunHistoryPurgeInterval 7.00:00:00

Microsoft.Synchronize.SchedulerSuspended False

Microsoft.Synchronize.ServerConfigurationVersion 2.5.3.0

Microsoft.Synchronize.StagingMode False

Microsoft.Synchronize.SynchronizationPolicy Delta

Microsoft.Synchronize.SynchronizationSchedule True

Microsoft.Synchronize.TimeInterval 00:30:00

Microsoft.SystemInformation.MachineRole RoleMemberServer

Microsoft.SystemInformation.TpmPresent False

Microsoft.UserSignIn.DesktopSsoEnabled False

Microsoft.UserSignIn.SignOnMethod PasswordHashSync

Microsoft.UserWriteBack.Container

Microsoft.UserWriteBack.Forest

Microsoft.Version.SynchronizationRuleImmutableTag V1

Answer 1

removed this duplicate comment

Answer 2

Thank you for sharing the issue in detail. Based on your description, it appears that you've upgraded Azure AD Connect (AAD Connect) from version 2.4.131.0 to 2.5.3.0, and are now encountering the following error when launching the configuration wizard:

"ApplicationManagedBy is not set correctly"

This error typically occurs in the new versions of Azure AD Connect when there is a mismatch or configuration issue in the application registration used for token-based authentication.

Root Cause

Starting with Azure AD Connect v2.1.15.0, Microsoft introduced Azure AD Application-based authentication as a replacement for using a service account. In version 2.5.3.0, this method is enforced more strictly.

The error you're seeing is related to the internal global settings object Microsoft.AADConnector.ApplicationManagedBy, which is used to define how the Azure AD connector authenticates to Entra ID (Azure AD). The value should be one of the following:

MSOL — if you're using a service account.

EntraConnectSync — if you're using the new application-based method.

In your case:

(Get-ADSyncGlobalSettings).Parameters["Microsoft.AADConnector.ApplicationManagedBy"]

is returning EntraConnectSync, which is correct for application-based authentication. However, the error implies that internally AAD Connect is not recognizing this state properly—potentially due to a partial or incorrect upgrade/configuration.

---

Recommended Steps to Resolve

Step 1: Confirm Application Registration

Verify the Azure AD Application registration created during the upgrade:

Go to Azure Portal → Azure Active Directory → App registrations.

Locate the application named similar to:

Azure AD Connect Sync

Open it, and verify:

API permissions include Directory.ReadWrite.All, User.Read, etc.

  **Client secret** is present and valid.
  
     The application **was created/last modified** at the time of your upgrade.
     

⚠ If you don't see the expected application, the upgrade may have failed to register it properly.

---

Step 2: Reconfigure Azure AD Connect

Try reconfiguring the AAD Connect setup:

Open Command Prompt as Administrator.

Run:

"C:\Program Files\Microsoft Azure AD Sync\AzureADConnect.exe"

Instead of running the regular wizard, try using "Change user sign-in" or "Configure staging mode" — both options reinitialize parts of the application linkage.

Walk through the wizard and reauthenticate against Azure AD.

If you’re prompted to use the application-based authentication, accept and complete the wizard. This step should refresh internal pointers and re-validate ApplicationManagedBy.

---

Step 3: Force Sync Reauthentication

Run the following PowerShell commands to reset and test credentials:

Import-Module ADSync
Set-ADSyncBasicReadOnlyPermission -ConnectorName "your-AAD-connector-name" # replace with actual connector name
Get-ADSyncConnector | Select Name,Type

# Test the application credentials
Get-ADSyncEntraConnectorCredential

If Get-ADSyncEntraConnectorCredential still throws the same error, it might be a deeper corruption of global settings or application mismatch.

---

Step 4: Manual Repair (Advanced)

Use this with caution. Always take a backup first.

Export current configuration:

Start-ADSyncExportServerConfiguration -Path "C:\Backup\AADConnectBackup.xml"

Uninstall Azure AD Connect via Control Panel.

Clean up any remaining folders in:

C:\Program Files\Microsoft Azure AD Sync\

  `C:\ProgramData\AADConnect\`
  
  Reinstall the **same version (2.5.3.0)** fresh from: [https://www.microsoft.com/en-us/download/details.aspx?id=47594](https://www.microsoft.com/en-us/download/details.aspx?id=47594)
  
  During setup, import the previously saved config or recreate it as needed.
  

If You Need to Roll Back

If repair isn't feasible and you'd prefer to roll back:

Uninstall version 2.5.3.0.

Reinstall version 2.4.131.0 (you’ll need to have the original installer).

Restore the backup configuration if taken earlier.

Be cautious — rolling back may not be straightforward if Entra ID (Azure AD) already switched to the application-based model.

---

Documentation & Reference

Azure AD Connect: Troubleshooting Application Authentication

• Azure AD Connect version history

---

Summary

The value of ApplicationManagedBy seems correct.

The issue likely results from an incomplete or inconsistent upgrade.

Re-running the configuration wizard or reinstalling AAD Connect often resolves internal inconsistencies.

Rolling back should be your last option due to changes introduced in newer versions.

Let us know how these steps work for you or if you need help with any of the PowerShell commands. Happy to assist further!

---