ADConnect\ADSync Kerberos rollover Get-AzureADSSOStatus suddenly not working

Question

Hello,

I renew our Kerberos every month and suddenly I get this error:

PS C:\Program Files\Microsoft Azure Active Directory Connect> Import-Module .\AzureADSSO.psd1
PS C:\Program Files\Microsoft Azure Active Directory Connect> New-AzureADSSOAuthenticationContext
PS C:\Program Files\Microsoft Azure Active Directory Connect> New-AzureADSSOAuthenticationContext
PS C:\Program Files\Microsoft Azure Active Directory Connect> Get-AzureADSSOStatus |ConvertFrom-Json
Get-AzureADSSOStatus : One or more errors occurred.
At line:1 char:1

• Get-AzureADSSOStatus |ConvertFrom-Json
• ~~~~~~~~~~~~~~~~~~~~
• CategoryInfo : NotSpecified: (:) [Get-AzureADSSOStatus], AggregateException
• FullyQualifiedErrorId : System.AggregateException,Microsoft.KerberosAuth.Powershell.PowershellCommands.GetAzureA
  DSSOStatusCommand

I already tried using a space after | for ConvertFrom-JSon, same issue. I also tried another Global admin's credential, same error. If I type in only the Get-AzureADSSOStatus I get the same error. This works every month until today. Does anyone have the same issue after August Windows Update? Thank you.

Answer 1

Hi,

I just want to share the fix in case someone will run into the same issue. We discovered that the issue was about the URL we need to whitelist in Cisco Umbrella (although we are not blocking the port). It has always worked for us and suddenly got blocked. Microsoft support ran a log to review traffic from the AD Connect server and we found the offending URL that was filtered by the firewall when requesting and updating the SSO configuration in Azure AD.

Answer 2

I get the same error. I think there is suddenly an issue with the "Get-AzureADSSOStatus" command. I have no issue with the other "Get" commands.

Get-AzureADSSOStatus : One or more errors occurred.
At line:1 char:1

• Get-AzureADSSOStatus -verbose -debug
• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
• CategoryInfo : NotSpecified: (:) [Get-AzureADSSOStatus], AggregateException
• FullyQualifiedErrorId : System.AggregateException,Microsoft.KerberosAuth.Powershell.PowershellCommands.GetAzureA
  DSSOStatusCommand

My AADConnect version is 2.0.10.0. I upgraded it from 1.3, thinking that was the issue, but it did not fix the problem. I get the same error.

Thank you.

Answer 3

I am not aware of any issue at this time. It has been working for us. Also make sure that you are part of either the enterprise or domain admin when running the command. Otherwise, it won't work. This has been a thing for years. It wasn't like this when we started ADConnect.