Microsoft Entra Cloud Sync provisioning agent fails to register — "Service bootstrap request failed... Internal Server Error"

Question

I'm setting up Microsoft Entra Cloud Sync (AD to Microsoft Entra ID sync) on a domain controller (Windows Server, domain [unitex.local]). The Provisioning Agent installs successfully, the local service runs (AADConnectProvisioningAgent — Status: Running), and the setup wizard completes without errors (gMSA created, AD connection confirmed, credentials written to the Windows Credential Store).

However, the agent never shows as Active in the Entra admin center (Entra Connect → Cloud Sync → Agents) — it stays Inactive indefinitely.

Error from the agent trace log (C:\ProgramData\Microsoft\Azure AD Connect Provisioning Agent\Trace\AzureADConnectProvisioningAgent_*.log), repeating every ~30 seconds:

AADConnectProvisioningAgent.exe Error: 0 : Service bootstrap request failed with exception.
Request Id: '2895f222-00eb-4097-b069-f2450024c624'
Error: 'System.ServiceModel.CommunicationException: Internal Server Error
   at System.ServiceModel.Dispatcher.WebFaultClientMessageInspector.AfterReceiveReply(...)
   at ...Microsoft.ApplicationProxy.Connector.Bootstrap.BootstrapManager.<SendBootstrapRequestAsync>...'

Windows Event Log (Application) also showed (now resolved separately, see below):

Event ID 12015: The Agent failed to establish connection with the service.
Event ID 12009: Failed to initialize performance counters. You must uninstall and reinstall the Agent.

What I've already ruled out / fixed

• ✅ KDS Root Key created (was missing initially — fixed)
• ✅ xxxxxxx\AADConnectProvisioningAgent granted "Log on as a service" (was blocked by Default Domain Controllers Policy — fixed via GPO SID entry)
• ✅ PowerShell Execution Policy — RemoteSigned, not the issue
• ✅ Local Windows Firewall — disabled on all profiles, not blocking
• ✅ Network connectivity — tested outbound 443 to login.microsoftonline.com, login.windows.net, enterpriseregistration.windows.net, management.azure.com, ctldl.windowsupdate.com, secure.aadcdn.microsoftonline-p.com — all succeed
• ✅ TLS 1.2 — enabled at .NET Framework level (SchUseStrongCrypto, SystemDefaultTlsVersions) via registry
• ✅ Performance counter corruption (Event 12009) — fixed via lodctr /r; Event 12009/12015 no longer appear in Application log
• ✅ Completely uninstalled and reinstalled the agent (fresh gMSA ) — exact same bootstrap error persists

Given that a fully fresh install/registration still hits the same Internal Server Error immediately on bootstrap, and the exception is caught at WebFaultClientMessageInspector.AfterReceiveReply (implying an HTTP response WAS received from the service, just with a 500-level error), this looks like it may be a server-side issue rather than a client/network/firewall configuration problem.

Environment

• OS: Windows Server 2019 Standard
• Agent installed on: Domain Controller

Question

Has anyone seen this specific BootstrapManager.SendBootstrapRequestAsync → Internal Server Error failure persist across a completely fresh agent install/gMSA? Is there a known tenant-side configuration or service principal issue that could cause this? Any guidance on what else to check, or whether this needs a support ticket, would be appreciated.

Answer 1

The supported checks for this scenario point to four areas:

1. Verify the agent is actually healthy in both places
   • In Microsoft Entra admin center: Entra ID > Entra Connect > Cloud sync > cloud sync. The agent should appear and show active (green).
   • On the server: open Services.msc and confirm Microsoft Entra Provisioning Agent and Microsoft Entra Connect Agent Updater are present and Running.
2. Recheck outbound connectivity requirements used by bootstrap and registration
   • Required outbound ports are 80 and 443.
   • Required URL access includes *.msappproxy.net, *.servicebus.windows.net, login.windows.net, *.microsoftonline.com, *.microsoftonline-p.com, *.msauth.net, *.msauthimages.net, *.msecnd.net, *.msftauth.net, *.msftauthimages.net, *.phonefactor.net, enterpriseregistration.windows.net, management.azure.com, policykeyservice.dc.ad.msft.net, ctldl.windowsupdate.com, and www.microsoft.com/pkiops.
   • DNS resolution must work for the full CNAME chain for the Microsoft Entra endpoints, and outbound TLS inspection/termination should be avoided.
3. If a proxy is in the path, configure the agent for outbound proxy explicitly
   • A registration or bootstrap timeout/certificate problem is documented as commonly caused by the agent being unable to connect to the Hybrid Identity Service.
   • Configure the proxy in: C:\Program Files\Microsoft Azure AD Connect Provisioning Agent\AADConnectProvisioningAgent.exe.config
   • Add before </configuration>:

<system.net>
    <defaultProxy enabled="true" useDefaultCredentials="true">
        <proxy
            usesystemdefault="true"
            proxyaddress="http://[proxy-server]:[proxy-port]"
            bypassonlocal="true"
        />
    </defaultProxy>
</system.net>

4. Collect the full agent logs for escalation
   • Trace logs are in: C:\ProgramData\Microsoft\Azure AD Connect Provisioning Agent\Trace
   • Install the AADCloudSyncTools PowerShell module and run Export-AADCloudSyncToolsLogs.
   • Useful switches:
     • SkipVerboseTrace
     • TracingDurationMins
     • OutputPath

For the specific Internal Server Error during bootstrap after a fresh reinstall: the available guidance does not document a tenant-side service principal setting as a known cause. The closest documented product behavior is:

• if the resource mapping is wrong, error HybridIdentityServiceInvalidResource requires re-registering the cloud sync agent and restarting configuration from the portal
• if Service Bus cannot send to the agent, error HybridIdentityServiceAgentSignalingError should be escalated with the Job ID

Since reinstallation has already been completed and the bootstrap call is still receiving a server error, the supported next step is to capture the agent logs and open support with the Request ID/Job ID from the failing operation.

---

References:

• Cloud sync troubleshooting
• Troubleshoot on-premises application provisioning
• Microsoft Entra Cloud Sync error codes and descriptions