Error installing entra connect sync

Question

Error installing entra connect sync

Galied Mahmood 0

Microsoft Entra Connect could not configure application-based authentication for this server. Setup cannot continue.

Jyotishree Moharana 1,865 Reputation points Microsoft External Staff Moderator

2026-07-17T07:03:00.8566667+00:00

Hello @Galied Mahmood,

Greetings,

Most of the common causes of this error are: Server cannot reach Microsoft Entra authentication endpoints or TLS 1.2 or Schannel configuration issues or Missing trusted root certificates or Global Administrator authentication failure or Certificate registration mismatch (AADSTS700027) or Existing or duplicated ABA configuration on another Entra Connect server.

We recommend trying the below troubleshooting steps:

1. Verify Network Connectivity

PowerShell Run: Test-NetConnection login.microsoftonline.com -Port 443

Expected output: TcpTestSucceeded : True

Also confirm you can browse to: https://login.microsoftonline.com from the Entra Connect server.

2. Verify Global Administrator Credentials

Sign in manually to the Entra Admin Center from the Entra Connect server.

Ensure the account used during setup is:

Global Administrator

Not a guest account

Not blocked by Conditional Access or MFA issues

3. Verify TLS 1.2 is Enabled

Check that the server supports TLS 1.2.

PowerShell: [Net.ServicePointManager]::SecurityProtocol

Ensure Windows is fully patched and TLS 1.2 is enabled.

4. Validate Schannel PKCS Settings

Open Registry Editor and navigate to: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS

Check: Enabled = 1

If set to: 0 change it or remove the value and reboot the server.

5. Verify Root Certificates

Open: certlm.msc

Browse to: Trusted Root Certification Authorities

Verify required certificates exist:

DigiCert Global Root G2

DigiCert Global Root CA

6. Validate Proxy and Firewall Configuration

Allow outbound HTTPS (443) access to:

login.microsoftonline.com

*.msappproxy.net

Microsoft Graph endpoints

Ensure the proxy does not require interactive authentication.

7. Review Entra Connect Logs

Check logs under: %LocalAppData%\AADConnect\

Search for: AADSTS, MSAL, Graph, certificate, client assertion, authentication

Particularly look for:

AADSTS7000272 The certificate used to sign the client assertion is not registered on application

8. Check for Existing ABA Configuration

If you have:

Active + Staging Entra Connect servers

A cloned server

Previously configured ABA

Verify the machine identifier:

PowerShell: Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Azure AD Connect" | Select-Object SyncMachineIdentifier

Duplicate identifiers can cause ABA registration conflicts.

9. Reconfigure ABA

If all validations pass but the issue persists:

Roll back to legacy authentication.

Remove the existing ABA configuration.

Re-run the Entra Connect wizard.

Re-enroll the server in ABA.

Kindly do try the suggested steps above and let us know of any questions or query.
G. Mahmood 0 Reputation points

2026-07-17T13:26:29+00:00

There is also possibility to use Cloud sync instead of Entra Connect.

Does Cloud sync have the Pass through authentication option?
Jyotishree Moharana 1,865 Reputation points Microsoft External Staff Moderator

2026-07-21T08:05:28.2633333+00:00

Hello @Galied Mahmood,

Cloud Sync only supports Password Hash Sync for cloud authentication, only Connect Sync supports Password Hash Sync, PTA, and Federation (AD FS).

If PTA is necessary then Connect sync configuration would be required.

Your answer

G. Mahmood 0 Reputation points

2026-07-17T13:26:29+00:00

There is also possibility to use Cloud sync instead of Entra Connect.

Does Cloud sync have the Pass through authentication option?
Jyotishree Moharana 1,865 Reputation points Microsoft External Staff Moderator

2026-07-21T08:05:28.2633333+00:00

Hello @Galied Mahmood,

Cloud Sync only supports Password Hash Sync for cloud authentication, only Connect Sync supports Password Hash Sync, PTA, and Federation (AD FS).

If PTA is necessary then Connect sync configuration would be required.