Unable to retrieve proxy configuration data from the Federation Service Hi guys, I got this. Open registry at your AD FS Proxy server and go to. If you leave your WAP server offline for more than 2 weeks, the proxy trust certificate will expire and you’ll need to re-initialise the proxy trust (which is what I did with the Install-WebApplicationProxy cmdlet). This can also happen when you move your VM’s configuration to another storage – as was my case!

This article explains how connectivity between Azure AD Connect and Azure AD works and how to troubleshoot connectivity issues. These issues are most likely to be seen in an environment with a proxy server.

Troubleshoot connectivity issues in the installation wizard

Azure AD Connect is using Modern Authentication (using the ADAL library) for authentication. The installation wizard and the sync engine proper require machine.config to be properly configured since these two are .NET applications.

In this article, we show how Fabrikam connects to Azure AD through its proxy. The proxy server is named fabrikamproxy and is using port 8080.

First we need to make sure machine.config is correctly configured.

Note

In some non-Microsoft blogs, it is documented that changes should be made to miiserver.exe.config instead. However, this file is overwritten on every upgrade so even if it works during initial install, the system stops working on first upgrade. For that reason, the recommendation is to update machine.config instead.

The proxy server must also have the required URLs opened. The official list is documented in Office 365 URLs and IP address ranges.

Of these URLs, the following table is the absolute bare minimum to be able to connect to Azure AD at all. This list does not include any optional features, such as password writeback, or Azure AD Connect Health. It is documented here to help in troubleshooting for the initial configuration.

Errors in the wizard

The installation wizard is using two different security contexts. On the page Connect to Azure AD, it is using the currently signed in user. On the page Configure, it is changing to the account running the service for the sync engine. If there is an issue, it appears most likely already at the Connect to Azure AD page in the wizard since the proxy configuration is global.

The following issues are the most common errors you encounter in the installation wizard.

The installation wizard has not been correctly configured

This error appears when the wizard itself cannot reach the proxy.

• If you see this error, verify the machine.config has been correctly configured.
• If that looks correct, follow the steps in Verify proxy connectivity to see if the issue is present outside the wizard as well.

A Microsoft account is used

If you use a Microsoft account rather than a school or organization account, you see a generic error.

The MFA endpoint cannot be reached

This error appears if the endpoint https://secure.aadcdn.microsoftonline-p.com cannot be reached and your global admin has MFA enabled.

• If you see this error, verify that the endpoint secure.aadcdn.microsoftonline-p.com has been added to the proxy.

The password cannot be verified

If the installation wizard is successful in connecting to Azure AD, but the password itself cannot be verified you see this error:

• Is the password a temporary password and must be changed? Is it actually the correct password? Try to sign in to https://login.microsoftonline.com (on another computer than the Azure AD Connect server) and verify the account is usable.

Verify proxy connectivity

To verify if the Azure AD Connect server has actual connectivity with the Proxy and Internet, use some PowerShell to see if the proxy is allowing web requests or not. In a PowerShell prompt, run Invoke-WebRequest -Uri https://adminwebservice.microsoftonline.com/ProvisioningService.svc. (Technically the first call is to https://login.microsoftonline.com and this URI works as well, but the other URI is faster to respond.)

PowerShell uses the configuration in machine.config to contact the proxy. The settings in winhttp/netsh should not impact these cmdlets.

If the proxy is correctly configured, you should get a success status:

If you receive Unable to connect to the remote server, then PowerShell is trying to make a direct call without using the proxy or DNS is not correctly configured. Make sure the machine.config file is correctly configured.

If the proxy is not correctly configured, you get an error:

Proxy idle timeout setting

When Azure AD Connect sends an export request to Azure AD, Azure AD can take up to 5 minutes to process the request before generating a response. This can happen especially if there are a number of group objects with large group memberships included in the same export request. Ensure the Proxy idle timeout is configured to be greater than 5 minutes. Otherwise, intermittent connectivity issue with Azure AD may be observed on the Azure AD Connect server.

The communication pattern between Azure AD Connect and Azure AD

If you have followed all these preceding steps and still cannot connect, you might at this point start looking at network logs. This section is documenting a normal and successful connectivity pattern. It is also listing common red herrings that can be ignored when you are reading the network logs.

• There are calls to https://dc.services.visualstudio.com. It is not required to have this URL open in the proxy for the installation to succeed and these calls can be ignored.
• You see that dns resolution lists the actual hosts to be in the DNS name space nsatc.net and other namespaces not under microsoftonline.com. However, there are not any web service requests on the actual server names and you do not have to add these URLs to the proxy.
• The endpoints adminwebservice and provisioningapi are discovery endpoints and used to find the actual endpoint to use. These endpoints are different depending on your region.

Reference proxy logs

Here is a dump from an actual proxy log and the installation wizard page from where it was taken (duplicate entries to the same endpoint have been removed). This section can be used as a reference for your own proxy and network logs. The actual endpoints might be different in your environment (in particular those URLs in italic).

Connect to Azure AD

Configure

Initial Sync

Authentication errors

This section covers errors that can be returned from ADAL (the authentication library used by Azure AD Connect) and PowerShell. The error explained should help you in understand your next steps.

Invalid Grant

Invalid username or password. For more information, see The password cannot be verified.

Unknown User Type

Your Azure AD directory cannot be found or resolved. Maybe you try to login with a username in an unverified domain?

User Realm Discovery Failed

Network or proxy configuration issues. The network cannot be reached. See Troubleshoot connectivity issues in the installation wizard.

User Password Expired

Your credentials have expired. Change your password.

Authorization Failure

Failed to authorize user to perform action in Azure AD.

Authentication Canceled

The multi-factor authentication (MFA) challenge was canceled.

Connect To MS Online Failed

Authentication was successful, but Azure AD PowerShell has an authentication problem.

Azure AD Global Admin Role Needed

User was authenticated successfully. However user is not assigned global admin role. This is how you can assign global admin role to the user.

Privileged Identity Management Enabled

Authentication was successful. Privileged identity management has been enabled and you are currently not a global administrator. For more information, see Privileged Identity Management.

Company Information Unavailable

Authentication was successful. Could not retrieve company information from Azure AD.

Domain Information Unavailable

Authentication was successful. Could not retrieve domain information from Azure AD.

Unspecified Authentication Failure

Shown as Unexpected error in the installation wizard. Can happen if you try to use a Microsoft Account rather than a school or organization account.

Troubleshooting steps for previous releases.

With releases starting with build number 1.1.105.0 (released February 2016), the sign-in assistant was retired. This section and the configuration should no longer be required, but is kept as reference.

For the single-sign in assistant to work, winhttp must be configured. This configuration can be done with netsh.

The Sign-in assistant has not been correctly configured

This error appears when the Sign-in assistant cannot reach the proxy or the proxy is not allowing the request.

• If you see this error, look at the proxy configuration in netsh and verify it is correct.
• If that looks correct, follow the steps in Verify proxy connectivity to see if the issue is present outside the wizard as well.

Next steps

Learn more about Integrating your on-premises identities with Azure Active Directory.

So we had ADFS setup and working but then had some cert issues which made a real mess. Right not I have everything internally working with the local ADFS and single sign on for some apps. I am having issues with our ADFS proxy that sits in the DMZ.I can not get it to create the trust again. On the Proxy server I get the following errors in event log when trying to connect:Event 391: The federation server Proxy was able to successfully establish a trust with the federation serviceEvent 422: Unable to retrieve proxy configuration data from the federation service.On the local ADFS server I getEvent 276: The federation server proxy was not able to authenticate to the federation service.I am using a new wild card cert and its installed on both servers.

I have tried several different log in credential's to setup the trust with the same results. Removed and reinstalled the proxy service on the ADFS proxy serverI am at a lost on what to try next any help would be great.