how do i access troubleshooting application proxy services

Question

I am trying to use a connect to learn application through the York region boards Sharepoint BWW and i am unable to access it as it says : Single sign on to on-premises Active Directory using KCD failed. The user account used on the on-premises Active Directory is locked. For more details, check the Application Proxy Connector Event Log for reported errors.

When i click a link below that says :Troubleshoot Application Proxy serviceit says the request is blocked.

how can i fix this.

Answer 1

Hello Rebecca,

Thank you for posting your question on the Microsoft Windows Forum!

The most important finding is the error message itself:

Single sign on to on-premises Active Directory using KCD failed.
The user account used on the on-premises Active Directory is locked.

This suggests that the problem is not with your SharePoint link or browser, but that the Active Directory account being used for authentication is currently locked or cannot complete Kerberos Constrained Delegation (KCD) authentication.

What this means

As an end user, you typically cannot access the Application Proxy Connector Event Log yourself. Those logs are located on the organization's on-premises Application Proxy Connector server and are only available to administrators. Microsoft documents these logs under:

Event Viewer
→ Applications and Services Logs
→ Microsoft
→ Microsoft Entra Private Network
→ Connector
→ Admin

for troubleshooting Application Proxy issues. [learn.microsoft.com]

Highest-value next step

Since the error specifically states that the account used in on-premises Active Directory is locked, I would recommend contacting your organization's IT support team (York Region DSB IT/Help Desk) and providing them with the complete error message.

Ask them to verify:

- Whether your Active Directory account is locked
- Whether your password has expired
- Whether there are Application Proxy Connector errors related to your account
- Whether the KCD configuration is functioning correctly

Microsoft References

• Troubleshoot Application Proxy issues and errors [learn.microsoft.com]
• Troubleshoot Kerberos constrained delegation [learn.microsoft.com]

Could you confirm whether you are able to sign in successfully to other York Region DSB resources using the same account, or does the problem occur only when accessing this specific application?

I hope this answer has brought you useful information. If so, please click on Accept Answer and consider upvoting it. Doing so helps other community members identify useful solutions to similar issues.

Answer 2

The York Region board’s IT administrator must unlock your on-premises Active Directory account; this Application Proxy/Kerberos constrained delegation (KCD) error cannot normally be corrected from your personal device.

What to do as the user

1. Stop retrying the link temporarily. Repeated attempts with an old or incorrect password can trigger further lockouts.
2. Contact the school board’s IT/help desk, not Microsoft consumer account support. Provide:
   • The exact message: “Single sign on to on-premises Active Directory using KCD failed. The user account used on the on-premises Active Directory is locked.”
   • Your board username, the Connect to Learn application name, and the time the error occurred.
   • A screenshot containing any Transaction ID and Timestamp, but do not send your password.
3. Ask IT to:
   • Unlock the corresponding on-premises AD account.
   • Verify that it is enabled and correctly mapped to your Microsoft Entra identity.
   • Check whether an old password remains stored on another device, application, or service. Stored old credentials can repeatedly lock an account after it has been unlocked.^1^
4. After IT confirms the account is unlocked, sign out of the board’s SharePoint/Microsoft 365 session, close the browser, reopen it, and sign in with the current school-board account and password.

The blocked MSDN link is not required. The current public troubleshooting page is Troubleshoot application proxy issues and errors.^2^

Checks for the school-board administrator

On the server hosting the Microsoft Entra private network connector:

1. Open Event Viewer.
2. Navigate to: Applications and Services Logs → Microsoft → Microsoft Entra private network → Connector → Admin.
3. Correlate events with the user’s Transaction ID and Timestamp. Microsoft identifies this as the connector event-log location for KCD failures.^3^
4. Confirm that the Microsoft Entra private network connector Windows service is enabled and running.^2^
5. Unlock the user in on-premises AD and investigate the source of repeated bad-password attempts. If lockouts continue, review domain-controller security events—particularly account lockout event 4740—to identify when and where the lockout originates.^1^
6. Only if the account is no longer locked but KCD still fails, continue with the KCD checks for delegation permissions, duplicate or incorrect service principal names (SPNs), IIS Windows Authentication, and the application-pool identity.^3^

Changing browser settings, clearing the cache, or repairing Windows will not unlock an organization-managed on-premises AD account.

---

References

1. Troubleshoot account lockout problems with a Microsoft Entra Domain Services managed domain
2. Troubleshoot application proxy issues and errors
3. Troubleshoot Kerberos constrained delegation