Error 0x80070643 while installing Microsoft Entra Provisioning Agent (AADConnectProvisioningAgent)

Question

Error 0x80070643 while installing Microsoft Entra Provisioning Agent (AADConnectProvisioningAgent)

Jessica Fraga 0

User's image I'm trying to install the Microsoft Entra Provisioning Agent (AADConnectProvisioningAgentSetup.exe) on a Windows 10 x64 machine.

The installation always fails with Error 0x80070643 when executing the MSI Microsoft.SCIM.Provisioning.Setup.msi.

Environment

OS: Windows 10 x64 (Build 22631)
Installer version: 5.0.2.0
.NET Framework: Installed (condition NETFRAMEWORK45 >= 461808 evaluates to true)
Installation executed as local administrator
Windows Update enabled

Expected behavior

The provisioning agent should install successfully.

Actual behavior

The MSI installation fails with error 0x80070643 and rolls back.

Relevant log excerpt (sanitized)

i301: Applying execute package: Microsoft.SCIM.Provisioning.Setup.msi e000: Error 0x80070643: Failed to install MSI package. e000: Error 0x80070643: Failed to execute MSI package. e000: Error 0x80070643: Failed to configure per-machine MSI package.

The full installer runs without UI (WixStdBASuppressOptionsUI=1). No additional error is shown on screen.

Has anyone encountered this issue with the Entra Provisioning Agent? Are there known prerequisites, permissions, or Windows components that could cause this MSI error during installation?

Any guidance would be appreciated. ``

Rukmini 35,245 Reputation points Microsoft External Staff Moderator

2026-03-26T20:11:24.3566667+00:00

Hello Jessica Fraga

Please check this https://learn.microsoft.com/en-us/answers/questions/1662163/unable-to-unistall-microsoft-entra-provisioning-ag and let me know if it works!
Rukmini 35,245 Reputation points Microsoft External Staff Moderator

2026-03-27T17:36:23.7766667+00:00

Hello Jessica Fraga Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Jessica Fraga 0 Reputation points

2026-03-27T19:30:10.73+00:00

Não consegui
Rukmini 35,245 Reputation points Microsoft External Staff Moderator

2026-03-27T21:26:15.07+00:00
Hello Jessica Fraga

I understand you trying to deploy the API-Driven Provisioning for On-Prem and is facing issues while installing the Microsoft Entra Provisioning Agent Package.

The error message you received indicates that there was a missing MSI package, and the installation failed.

To troubleshoot this issue, can you try the following steps:

Check if the MSI package is available in the specified location. If it is not available, try downloading it again and then run the installation.

Check if the Windows Installer service is running. If it is not running, start the service and then try the installation again.

Check if there are any antivirus or firewall settings that are blocking the installation. If there are any such settings, temporarily disable them and then try the installation again.

Regarding the error message you received while trying to uninstall the files, it seems like the MSI package could not be uninstalled. You can try the following steps to uninstall the package:

Open the Control Panel and go to Programs and Features.

Find the Microsoft Entra Provisioning Agent Package in the list of installed programs and select it.

Click on Uninstall and follow the prompts to uninstall the package.

For additional troubleshooting regarding this concern, kindly check out this article

https://support.microsoft.com/en-us/windows/windows-update-troubleshooter-19bc41ca-ad72-ae67-af3c-89ce169755dd#WindowsVersion=Windows_10

Regarding the active agent that you see under API Driven App > Provisioning > Admin Credentials > View On-premise Agents, it is possible that the agent was installed successfully before the error occurred. However, to be sure, you can check the agent logs to see if there are any errors or warnings.

Hope this helps. Do let us know if you any further queries.I understand you trying to deploy the API-Driven Provisioning for On-Prem and is facing issues while installing the Microsoft Entra Provisioning Agent Package.

The error message you received indicates that there was a missing MSI package, and the installation failed.

To troubleshoot this issue, can you try the following steps:

Check if the MSI package is available in the specified location. If it is not available, try downloading it again and then run the installation.

Check if the Windows Installer service is running. If it is not running, start the service and then try the installation again.

Check if there are any antivirus or firewall settings that are blocking the installation. If there are any such settings, temporarily disable them and then try the installation again.

Regarding the error message you received while trying to uninstall the files, it seems like the MSI package could not be uninstalled. You can try the following steps to uninstall the package:

Open the Control Panel and go to Programs and Features.

Find the Microsoft Entra Provisioning Agent Package in the list of installed programs and select it.

Click on Uninstall and follow the prompts to uninstall the package.

For additional troubleshooting regarding this concern, kindly check out this article

https://support.microsoft.com/en-us/windows/windows-update-troubleshooter-19bc41ca-ad72-ae67-af3c-89ce169755dd#WindowsVersion=Windows_10

Regarding the active agent that you see under API Driven App > Provisioning > Admin Credentials > View On-premise Agents, it is possible that the agent was installed successfully before the error occurred. However, to be sure, you can check the agent logs to see if there are any errors or warnings.

Hope this helps. Do let us know if you any further queries.
Rukmini 35,245 Reputation points Microsoft External Staff Moderator

2026-03-30T19:57:58.37+00:00

Hello Jessica Fraga Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Raja Pothuraju 47,080 Reputation points Microsoft External Staff Moderator

2026-04-01T12:08:04.0833333+00:00

@Jessica Fraga, Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

1 answer

Your answer

Rukmini 35,245 Reputation points Microsoft External Staff Moderator

2026-03-26T20:11:24.3566667+00:00

Hello Jessica Fraga

Please check this https://learn.microsoft.com/en-us/answers/questions/1662163/unable-to-unistall-microsoft-entra-provisioning-ag and let me know if it works!
Rukmini 35,245 Reputation points Microsoft External Staff Moderator

2026-03-27T17:36:23.7766667+00:00

Hello Jessica Fraga Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Jessica Fraga 0 Reputation points

2026-03-27T19:30:10.73+00:00

Não consegui
Rukmini 35,245 Reputation points Microsoft External Staff Moderator

2026-03-30T19:57:58.37+00:00

Hello Jessica Fraga Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Raja Pothuraju 47,080 Reputation points Microsoft External Staff Moderator

2026-04-01T12:08:04.0833333+00:00

@Jessica Fraga, Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

Answer 1

Error 0x80070643 during installation of the Microsoft Entra Provisioning Agent usually indicates that the MSI could not complete because the Windows service account for the agent could not be created or started, or because a previous/partial installation is blocking setup.

Based on the documented agent issues, focus on these areas:

Verify prerequisites
- Ensure all prerequisites for Microsoft Entra Connect cloud sync are met on the Windows 10 machine, including TLS 1.2 and required components. The provisioning agent setup assumes these are in place.
Check for previous/partial agent installations
- Open Services.msc and look for:
  - Microsoft Entra Provisioning Agent
  - Microsoft Entra Connect Agent Updater
- If they exist but are not running or are stuck in Starting, this can cause MSI failures. In that case:
  1. Uninstall any existing Microsoft Entra Provisioning Agent from Apps & Features.
  2. Confirm the services are removed.
  3. Reboot and then rerun the installer.
Group Policy / “log on as a service” rights
- The installer creates a local service account NT SERVICE\AADConnectProvisioningAgent and grants it Log on as a service. If local or domain Group Policy prevents this, the service cannot start and the MSI fails.
- On the machine:
  1. Run secpol.msc → Local Policies → User Rights Assignment → Log on as a service.
  2. Ensure the entry NT SERVICE\ALL SERVICES is present. If it is missing, add it and apply policy.
- If the policy is controlled by a domain GPO, adjust the GPO so that NT SERVICE\ALL SERVICES (or at least the agent service account) is allowed.
Manually set the service logon account (if the service is created but fails to start)
- If the MSI gets far enough to create the service but it fails to start:
  1. Open Services.msc.
  2. Open Microsoft Entra Provisioning Agent → Log On tab.
  3. Change This account to a domain administrator account.
  4. Apply and start the service, then rerun the installer if it rolled back.
Domain controller / policy considerations
- If this Windows 10 machine is a domain controller or has DC-like policies applied, the same restrictions that affect DC installations can apply (for example, policies blocking local service accounts). In such cases, either:
  - Relax the policy to allow the service account as above, or
  - Install the provisioning agent on a non‑DC server that meets the prerequisites.
Review the detailed MSI log
- In addition to the bootstrapper log you already have, review the MSI log for Microsoft.SCIM.Provisioning.Setup.msi for entries about:
  - Failure to grant Log on as a service
  - Failure to start AADConnectProvisioningAgent
- These messages typically confirm that policy or service‑startup issues are the root cause.

After ensuring prerequisites are met, removing any stale installation, and confirming NT SERVICE\\ALL SERVICES has Log on as a service rights (or assigning a domain admin account to the service), rerun the provisioning agent installer; in the documented cases, the wizard then completes successfully.

References:

Share via

Error 0x80070643 while installing Microsoft Entra Provisioning Agent (AADConnectProvisioningAgent)

Environment

Expected behavior

Actual behavior

Relevant log excerpt (sanitized)

1 answer

Your answer