Entra Cloud Sync

John Chapman 0 Reputation points
2026-08-17T18:47:34.0466667+00:00

We installed agent on Windows server.

Allowed all firewall exceptions.

When we go in and do Provision on demand, then put in test user distinguished name.

It gives Error code InvalidCredentials

We tried opening ticket, but we going on two weeks now, without getting anywhere.

Any infomation is of greatly appreciated.

Microsoft Security | Microsoft Entra | Other
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bence Weiszmann 650 Reputation points
    2026-08-17T18:58:55.6833333+00:00

    Dear @John Chapman

    I’ve seen this before, and even though the error says InvalidCredentials, it doesn’t necessarily mean that the username or password is incorrect.

    With Cloud Sync, this error can also occur when the agent cannot authenticate properly against the source Active Directory.

    I’d start by checking which account is being used for the AD connection and whether that account has the required permissions. Also make sure the account isn’t being affected by authentication policies such as MFA or Conditional Access, as these can interfere with the authentication flow.

    If the credentials and permissions look correct, I’d also check the Microsoft Entra Cloud Sync agent logs on the server, as they usually provide more detail about where the authentication is failing.

    If you can share the exact error from the agent logs (with any sensitive information removed), it would be easier to narrow down what is actually causing the InvalidCredentials error.

    If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-08-17T18:47:47.5533333+00:00

    InvalidCredentials during Provision on demand indicates the cloud sync configuration cannot authenticate to the target directory or service for that provisioning flow.

    Use this end-to-end check:

    1. In the Microsoft Entra admin center, go to Entra ID > Entra Connect > Cloud sync.
    2. Select the affected configuration, then check the agent status.
      • The agent should appear and show active / healthy status.
    3. On the Windows server, verify the Microsoft Entra Connect cloud sync agent service is running.
    4. If the agent is installed behind a firewall or proxy, verify outbound connectivity is allowed:
      • Ports 80 and 443 must be open.
      • Required endpoints include *.msappproxy.net, *.servicebus.windows.net, login.windows.net, *.microsoftonline.com, management.azure.com, and the certificate revocation endpoints listed in the troubleshooting article.
    5. If an outbound proxy is used, configure the agent proxy settings in: C:\Program Files\Microsoft Azure AD Connect Provisioning Agent\AADConnectProvisioningAgent.exe.config
    6. Collect agent logs from: C:\ProgramData\Microsoft\Azure AD Connect Provisioning Agent\Trace For more detail, use Export-AADCloudSyncToolsLogs.
    7. Retry Provision on demand:
      • Go to Entra ID > Entra Connect > Cloud sync
      • Select the configuration
      • Select Provision on demand
      • Enter the user distinguished name and select Provision
    8. If the job is quarantined, open the configuration status and either:
      • Clear quarantine, or
      • select Restart sync

    If the agent is healthy and connectivity is confirmed, the next place to inspect is the provisioning logs and the detailed error shown on the left side of the Provision on demand results screen.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.