MODIFIED docs/identity/hybrid/cloud-sync/how-to-prerequisites.md

Modified by Justinha on Sep 29, 2025 5:05 PM
📖 View on learn.microsoft.com

+5 / -5 lines changed

Commit: Update Windows Server version requirements in docs

Changes:

Before

After

 
### Prerequisites for gMSA
 
The Active Directory schema in the gMSA domain's forest needs to be updated to Windows Server 2012 or later.
[PowerShell RSAT modules](/windows-server/remote/remote-server-administration-tools) on a domain controller.
At least one domain controller in the domain must be running Windows Server 2012 or later.
A domain joined server where the agent is being installed needs to be either Windows Server 2016 or later.
 
### Custom gMSA account
 
## In your on-premises environment
 
Identify a domain-joined host server running Windows Server 2016 or greater with a minimum of 4-GB RAM and .NET 4.7.1+ runtime.
The PowerShell execution policy on the local server must be set to Undefined or RemoteSigned.
If there's a firewall between your servers and Microsoft Entra ID, see [Firewall and proxy requirements](#firewall-and-proxy-requirements).

 
### Prerequisites for gMSA
 
- The Active Directory schema in the gMSA domain's forest needs to be updated to Windows Server 2012 or later.
- [PowerShell RSAT modules](/windows-server/remote/remote-server-administration-tools) on a domain controller.
- At least one domain controller in the domain must be running Windows Server 2012 or later.
- A domain-joined server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016 for the agent installation.
 
### Custom gMSA account
 
## In your on-premises environment
 
1. Identify a domain-joined host server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016 with a minimum of 4-GB RAM and .NET 4.7.1+ runtime.
2. The PowerShell execution policy on the local server must be set to Undefined or RemoteSigned.
3. If there's a firewall between your servers and Microsoft Entra ID, see [Firewall and proxy requirements](#firewall-and-proxy-requirements).

MODIFIED docs/identity/hybrid/cloud-sync/migrate-group-writeback.md

Modified by Justinha on Sep 29, 2025 5:05 PM
📖 View on learn.microsoft.com

+4 / -2 lines changed

Commit: Update Windows Server version requirements in docs

Changes:

Before

After

manager: mwongerapk
ms.service: entra-id
ms.topic: how-to
ms.date: 04/09/2025
ms.subservice: hybrid-cloud-sync
ms.author: jomondi
 
 - An on-premises Active Directory account with at least domain administrator permissions.
     
   Required to access the `adminDescription` attribute and copy it to the `msDS-ExternalDirectoryObjectId` attribute.
 - On-premises Active Directory Domain Services environment with Windows Server 2016 operating system or later.
     
   Required for the Active Directory Schema attribute `msDS-ExternalDirectoryObjectId`.
 - Provisioning agent with build version [1.1.1367.0](reference-version-history.md#) or later.
 - The provisioning agent must be able to communicate with the domain controllers on ports TCP/389 (LDAP) and TCP/3268 (global catalog).
     
 
 

manager: mwongerapk
ms.service: entra-id
ms.topic: how-to
ms.date: 09/29/2025
ms.subservice: hybrid-cloud-sync
ms.author: jomondi
 
 - An on-premises Active Directory account with at least domain administrator permissions.
     
   Required to access the `adminDescription` attribute and copy it to the `msDS-ExternalDirectoryObjectId` attribute.
 
 - On-premises Active Directory Domain Services environment that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016.
     
   Required for the Active Directory Schema attribute `msDS-ExternalDirectoryObjectId`.
 
 - Provisioning agent with build version [1.1.1367.0](reference-version-history.md#) or later.
 - The provisioning agent must be able to communicate with the domain controllers on ports TCP/389 (LDAP) and TCP/3268 (global catalog).
     

MODIFIED docs/identity/hybrid/connect/how-to-connect-pta-quick-start.md

Modified by Justinha on Sep 29, 2025 5:05 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update Windows Server version requirements in docs

Changes:

Before

After

ms.service: entra-id
ms.tgt_pltfrm: na
ms.topic: how-to
ms.date: 04/09/2025
ms.subservice: hybrid-connect
ms.author: jomondi
ms.custom: sfi-image-nochange
 
### In your on-premises environment
 
1. Identify a server running Windows Server 2016 or later to run Microsoft Entra Connect. If not enabled already, [enable TLS 1.2 on the server](./how-to-connect-install-prerequisites.md#enable-tls-12-for-azure-ad-connect). Add the server to the same Active Directory forest as the users whose passwords you need to validate. It should be noted that installation of Pass-Through Authentication agent on Windows Server Core versions isn't supported. 
2. Install the [latest version of Microsoft Entra Connect](https://www.microsoft.com/download/details.aspx?id=47594) on the server identified in the preceding step. If you already have Microsoft Entra Connect running, ensure that the version is supported.
 
    >[!NOTE]
    >Microsoft Entra Connect versions 1.1.557.0, 1.1.558.0, 1.1.561.0, and 1.1.614.0 have a problem related to password hash synchronization. If you *don't* intend to use password hash synchronization in conjunction with Pass-through Authentication, read the [Microsoft Entra Connect release notes](./reference-connect-version-history.md).
 
3. Identify one or more additional servers (running Windows Server 2016 or later, with TLS 1.2 enabled) where you can run standalone Authentication Agents. These additional servers are needed to ensure the high availability of requests to sign in. Add the servers to the same Active Directory forest as the users whose passwords you need to validate.
 
    >[!IMPORTANT]
    >In production environments, we recommend that you have a minimum of 3 Authentication Agents running on your tenant. There's a system limit of 40 Authentication Agents per tenant. And as best practice, treat all servers running Authentication Agents as Tier 0 systems (see [reference](/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material)).

ms.service: entra-id
ms.tgt_pltfrm: na
ms.topic: how-to
ms.date: 09/09/2025
ms.subservice: hybrid-connect
ms.author: jomondi
ms.custom: sfi-image-nochange
 
### In your on-premises environment
 
1. Identify a server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016 to run Microsoft Entra Connect. If not enabled already, [enable TLS 1.2 on the server](./how-to-connect-install-prerequisites.md#enable-tls-12-for-azure-ad-connect). Add the server to the same Active Directory forest as the users whose passwords you need to validate. It should be noted that installation of Pass-Through Authentication agent on Windows Server Core versions isn't supported. 
2. Install the [latest version of Microsoft Entra Connect](https://www.microsoft.com/download/details.aspx?id=47594) on the server identified in the preceding step. If you already have Microsoft Entra Connect running, ensure that the version is supported.
 
    >[!NOTE]
    >Microsoft Entra Connect versions 1.1.557.0, 1.1.558.0, 1.1.561.0, and 1.1.614.0 have a problem related to password hash synchronization. If you *don't* intend to use password hash synchronization in conjunction with Pass-through Authentication, read the [Microsoft Entra Connect release notes](./reference-connect-version-history.md).
 
3. Identify another server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016 with TLS 1.2 enabled where you can run standalone Authentication Agents. These additional servers are needed to ensure the high availability of requests to sign in. Add the servers to the same Active Directory forest as the users whose passwords you need to validate.
 
    >[!IMPORTANT]
    >In production environments, we recommend that you have a minimum of 3 Authentication Agents running on your tenant. There's a system limit of 40 Authentication Agents per tenant. And as best practice, treat all servers running Authentication Agents as Tier 0 systems (see [reference](/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material)).

MODIFIED docs/identity/hybrid/connect/tutorial-federation.md

Modified by Justinha on Sep 29, 2025 5:05 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update Windows Server version requirements in docs

Changes:

Before

After

ms.service: entra-id
ms.tgt_pltfrm: na
ms.topic: tutorial
ms.date: 04/09/2025
ms.subservice: hybrid-connect
ms.author: jomondi
ms.custom: sfi-image-nochange
 
To complete the tutorial, you need these items:
 
- A computer with [Hyper-V](/windows-server/virtualization/hyper-v/hyper-v-technology-overview) installed. We suggest that you install Hyper-V on a [Windows 10](/virtualization/hyper-v-on-windows/about/supported-guest-os) or [Windows Server 2016](/windows-server/virtualization/hyper-v/supported-windows-guest-operating-systems-for-hyper-v-on-windows) computer.
- An Azure subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
- An [external network adapter](/virtualization/hyper-v-on-windows/quick-start/connect-to-network), so the virtual machine can connect to the internet.
- A copy of Windows Server 2016.
- A [custom domain](~/fundamentals/add-custom-domain.md) that can be verified.
 
> [!NOTE]

ms.service: entra-id
ms.tgt_pltfrm: na
ms.topic: tutorial
ms.date: 09/29/2025
ms.subservice: hybrid-connect
ms.author: jomondi
ms.custom: sfi-image-nochange
 
To complete the tutorial, you need these items:
 
- A computer with [Hyper-V](/windows-server/virtualization/hyper-v/hyper-v-technology-overview) installed. We suggest that you install Hyper-V on a [Windows 10](/virtualization/hyper-v-on-windows/about/supported-guest-os) or [Windows Server 2022](/windows-server/virtualization/hyper-v/supported-windows-guest-operating-systems-for-hyper-v-on-windows) computer.
- An Azure subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
- An [external network adapter](/virtualization/hyper-v-on-windows/quick-start/connect-to-network), so the virtual machine can connect to the internet.
- A copy of Windows Server 2022.
- A [custom domain](~/fundamentals/add-custom-domain.md) that can be verified.
 
> [!NOTE]

MODIFIED docs/identity/hybrid/connect/tutorial-passthrough-authentication.md

Modified by Justinha on Sep 29, 2025 5:05 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update Windows Server version requirements in docs

Changes:

Before

After

manager: mwongerapk
ms.service: entra-id
ms.topic: tutorial
ms.date: 04/09/2025
ms.subservice: hybrid-connect
ms.author: jomondi
ms.custom: sfi-image-nochange
 
## Prerequisites
 
- A computer with [Hyper-V](/windows-server/virtualization/hyper-v/hyper-v-technology-overview) installed. We suggest that you install Hyper-V on a [Windows 10](/virtualization/hyper-v-on-windows/about/supported-guest-os) or [Windows Server 2016](/windows-server/virtualization/hyper-v/supported-windows-guest-operating-systems-for-hyper-v-on-windows) computer.
- An Azure subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
- An [external network adapter](/virtualization/hyper-v-on-windows/quick-start/connect-to-network), so the virtual machine can connect to the internet.
- A copy of Windows Server 2016.
- A [custom domain](~/fundamentals/add-custom-domain.md) that can be verified.
 
> [!NOTE]

manager: mwongerapk
ms.service: entra-id
ms.topic: tutorial
ms.date: 09/29/2025
ms.subservice: hybrid-connect
ms.author: jomondi
ms.custom: sfi-image-nochange
 
## Prerequisites
 
- A computer with [Hyper-V](/windows-server/virtualization/hyper-v/hyper-v-technology-overview) installed. We suggest that you install Hyper-V on a [Windows 10](/virtualization/hyper-v-on-windows/about/supported-guest-os) or [Windows Server 2022](/windows-server/virtualization/hyper-v/supported-windows-guest-operating-systems-for-hyper-v-on-windows) computer.
- An Azure subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
- An [external network adapter](/virtualization/hyper-v-on-windows/quick-start/connect-to-network), so the virtual machine can connect to the internet.
- A copy of Windows Server 2022.
- A [custom domain](~/fundamentals/add-custom-domain.md) that can be verified.
 
> [!NOTE]

MODIFIED docs/identity/hybrid/prerequisites.md

Modified by Justinha on Sep 29, 2025 5:05 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update Windows Server version requirements in docs

Changes:

Before

After

ms.service: entra-id
ms.topic: article
ms.tgt_pltfrm: na
ms.date: 04/09/2025
ms.subservice: hybrid
ms.author: jomondi
 
 
|Requirement|Description and more requirements|
|-----|-----|
|Windows server 2016 or greater that is or has:|• 4-GB RAM or more</br>• .NET 4.7.1 runtime or greater</br>• domain-joined</br>• PowerShell execution policy set to **Undefined** or **RemoteSigned**</br>• TLS 1.2 enabled</br>|
|Active Directory|• On-premises AD that has a forest functional level 2003 or higher|
|Microsoft Entra tenant|• A tenant in Azure that's  used to synchronize from on-premises|
 
 
|Requirement|Description and more requirements|
|-----|-----|
|Windows server 2016 or greater that is or has:|• 4-GB RAM or more</br>• .NET 4.6.2 runtime or greater</br>• domain-joined</br>• PowerShell execution policy set to **RemoteSigned**</br>• TLS 1.2 enabled</br>• if federation is being used, the AD FS severs must be Windows Server 2012 R2 or higher and TLS/SSL certificates must be configured.|
|Active Directory|• On-premises AD that has a forest functional level 2003 or higher</br>• a writeable domain controller|
|Microsoft Entra tenant|• A tenant in Azure used to synchronize from on-premises|

ms.service: entra-id
ms.topic: article
ms.tgt_pltfrm: na
ms.date: 09/29/2025
ms.subservice: hybrid
ms.author: jomondi
 
 
|Requirement|Description and more requirements|
|-----|-----|
|Windows Server 2022, Windows Server 2019, or Windows Server 2016 |• 4-GB RAM or more</br>• .NET 4.7.1 runtime or greater</br>• domain-joined</br>• PowerShell execution policy set to **Undefined** or **RemoteSigned**</br>• TLS 1.2 enabled</br>|
|Active Directory|• On-premises AD that has a forest functional level 2003 or higher|
|Microsoft Entra tenant|• A tenant in Azure that's  used to synchronize from on-premises|
 
 
|Requirement|Description and more requirements|
|-----|-----|
|Windows Server 2022, Windows Server 2019, and Windows Server 2016|• 4-GB RAM or more</br>• .NET 4.6.2 runtime or greater</br>• domain-joined</br>• PowerShell execution policy set to **RemoteSigned**</br>• TLS 1.2 enabled</br>• if federation is being used, the AD FS severs must be Windows Server 2012 R2 or higher and TLS/SSL certificates must be configured.|
|Active Directory|• On-premises AD that has a forest functional level 2003 or higher</br>• a writeable domain controller|
|Microsoft Entra tenant|• A tenant in Azure used to synchronize from on-premises|

MODIFIED docs/identity/hybrid/connect/how-to-connect-install-prerequisites.md

Modified by Justinha on Sep 29, 2025 4:31 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update Windows Server prerequisites in documentation

Changes:

Before

After

ms.tgt_pltfrm: na
ms.custom: no-azure-ad-ps-ref, sfi-ga-nochange
ms.topic: how-to
ms.date: 09/17/2025
ms.subservice: hybrid-connect
ms.author: jomondi
---
 
#### Installation prerequisites
 
- Microsoft Entra Connect must be installed on a domain-joined Windows Server 2016-2022. We recommend using domain-joined Windows Server 2022. You can deploy Microsoft Entra Connect on Windows Server 2016. However, since Windows Server 2016 is in extended support, you might need [a paid support program](/lifecycle/policies/fixed#extended-support) if you require support for this configuration. Installing on unsupported Windows Server version may cause service failures or unexpected behavior.
- The minimum .NET Framework version required is 4.6.2, and newer versions of .NET are also supported.  .NET version 4.8 and greater offers the best accessibility compliance.
- Microsoft Entra Connect can't be installed on Small Business Server or Windows Server Essentials before 2019 (Windows Server Essentials 2019 is supported). The server must be using Windows Server standard or better. 
- The Microsoft Entra Connect server must have a full GUI installed. Installing Microsoft Entra Connect on Windows Server Core isn't supported. 
- The Microsoft Entra Connect server must not have PowerShell Transcription Group Policy enabled if you use the Microsoft Entra Connect wizard to manage Active Directory Federation Services (AD FS) configuration. You can enable PowerShell transcription if you use the Microsoft Entra Connect wizard to manage sync configuration.

ms.tgt_pltfrm: na
ms.custom: no-azure-ad-ps-ref, sfi-ga-nochange
ms.topic: how-to
ms.date: 09/29/2025
ms.subservice: hybrid-connect
ms.author: jomondi
---
 
#### Installation prerequisites
 
- Microsoft Entra Connect must be installed on a domain-joined server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016. We recommend Windows Server 2022. You can deploy Microsoft Entra Connect on Windows Server 2016. However, since Windows Server 2016 is in extended support, you might need [a paid support program](/lifecycle/policies/fixed#extended-support) if you require support for this configuration. Installing on unsupported versions of Windows Server may cause service failures or unexpected behavior.
- The minimum .NET Framework version required is 4.6.2, and newer versions of .NET are also supported. The .NET version 4.8 and greater offers the best accessibility compliance.
- Microsoft Entra Connect can't be installed on Small Business Server or Windows Server Essentials before 2019 (Windows Server Essentials 2019 is supported). The server must be using Windows Server standard or better. 
- The Microsoft Entra Connect server must have a full GUI installed. Installing Microsoft Entra Connect on Windows Server Core isn't supported. 
- The Microsoft Entra Connect server must not have PowerShell Transcription Group Policy enabled if you use the Microsoft Entra Connect wizard to manage Active Directory Federation Services (AD FS) configuration. You can enable PowerShell transcription if you use the Microsoft Entra Connect wizard to manage sync configuration.

MODIFIED docs/identity/conditional-access/concept-conditional-access-cloud-apps.md

Modified by John Flores on Sep 29, 2025 1:23 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: [Conditional Access] Azure DevOps not part of Windows Azure Service Management API

Changes:

Before

After

 
- Azure CLI
- Azure Data Factory portal
- Azure DevOps
- Azure Event Hubs
- Azure PowerShell
- Azure Service Bus
- SQL Managed Instance
- Visual Studio subscriptions administrator portal
 
> [!NOTE]
> The Windows Azure Service Management API application applies to [Azure PowerShell](/powershell/azure/what-is-azure-powershell), which calls the [Azure Resource Manager API](/azure/azure-resource-manager/management/overview). It doesn't apply to [Microsoft Graph PowerShell](/powershell/microsoftgraph/overview), which calls the [Microsoft Graph API](/graph/overview).
 
For more information on how to set up a sample policy for Windows Azure Service Management API, see [Conditional Access: Require MFA for Azure management](policy-old-require-mfa-azure-mgmt.md).
 
> [!TIP]
> For Azure Government, you should target the Azure Government Cloud Management API application.
 

 
- Azure CLI
- Azure Data Factory portal
- Azure Event Hubs
- Azure PowerShell
- Azure Service Bus
- SQL Managed Instance
- Visual Studio subscriptions administrator portal
 
> [!CAUTION]
> Conditional Access policies associated with the Windows Azure Service Management API [no longer cover Azure DevOps](/azure/devops/organizations/accounts/conditional-access-policies?view=azure-devops#azure-resource-manager-audience).
 
> [!NOTE]
> The Windows Azure Service Management API application applies to [Azure PowerShell](/powershell/azure/what-is-azure-powershell), which calls the [Azure Resource Manager API](/azure/azure-resource-manager/management/overview). It doesn't apply to [Microsoft Graph PowerShell](/powershell/microsoftgraph/overview), which calls the [Microsoft Graph API](/graph/overview).
 
> [!TIP]
> For Azure Government, you should target the Azure Government Cloud Management API application.
 

MODIFIED docs/identity-platform/reference-error-codes.md

Modified by Owen Richards on Sep 29, 2025 5:09 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Fix link to SAML claims customization documentation

Changes:

Before

After

| AADSTS50117 | Failed to deserialize policy specified in the request's claim parameter. |
| AADSTS50120 | Unknown credential type, issue with the JWT header. Contact the tenant admin. |
| AADSTS50123 | Unknown claims transformation method '{method}' was specified for principal '{principalId}'. |
| AADSTS50124 | Invalid regular expression configured for claims transformation for this application. Contact your tenant admin to fix the claims mapping configuration. See [Customize SAML token claims](~/identity/saml-claims-customization.md) |
| AADSTS501241 | Mandatory Input '{paramName}' missing from transformation ID '{transformId}'. This error is returned while Microsoft Entra ID is trying to build a SAML response to the application. NameID claim or NameIdentifier is mandatory in SAML response and if Microsoft Entra ID failed to get source attribute for NameID claim, it returns this error. As a resolution, ensure that you add claim rules. To add claim rules, sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator), and then browse to **Entra ID** > **Enterprise apps**. Select your application, select **Single Sign-On** and then in **User Attributes & Claims** enter the Unique User Identifier (Name ID). |
| AADSTS50125 | PasswordResetRegistrationRequiredInterrupt - Sign-in was interrupted because of a password reset or password registration entry. |
| AADSTS50126 | InvalidUserNameOrPassword - Error validating credentials due to invalid username or password. The user didn't enter the right credentials. Expect to see some number of these errors in your logs due to users making mistakes. |
| AADSTS50170 | MissingExternalClaimsProviderMapping - The external controls mapping is missing. |
| AADSTS50171 | The given audience can only be used in Mutual-TLS token calls. |
| AADSTS50172 | External claims provider {provider} isn't approved. |
| AADSTS50173 | The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '{authTime}' and the TokensValidFrom date (before which tokens are not valid) for this user is '{validDate}'. To learn more, see the troubleshooting article for error [AADSTS50173](/troubleshoot/entra/app-integration/error-code-aadsts50173-grant-expired-revoked.md). |
| AADSTS50176 | Missing definition of external control: {controlId}. |
| AADSTS50177 | ExternalChallengeNotSupportedForPassthroughUsers - External challenge isn't supported for passthrough users. |
| AADSTS50178 | SessionControlNotSupportedForPassthroughUsers - Session control isn't supported for passthrough users. |

| AADSTS50117 | Failed to deserialize policy specified in the request's claim parameter. |
| AADSTS50120 | Unknown credential type, issue with the JWT header. Contact the tenant admin. |
| AADSTS50123 | Unknown claims transformation method '{method}' was specified for principal '{principalId}'. |
| AADSTS50124 | Invalid regular expression configured for claims transformation for this application. Contact your tenant admin to fix the claims mapping configuration. See [Customize SAML token claims](saml-claims-customization.md) |
| AADSTS501241 | Mandatory Input '{paramName}' missing from transformation ID '{transformId}'. This error is returned while Microsoft Entra ID is trying to build a SAML response to the application. NameID claim or NameIdentifier is mandatory in SAML response and if Microsoft Entra ID failed to get source attribute for NameID claim, it returns this error. As a resolution, ensure that you add claim rules. To add claim rules, sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator), and then browse to **Entra ID** > **Enterprise apps**. Select your application, select **Single Sign-On** and then in **User Attributes & Claims** enter the Unique User Identifier (Name ID). |
| AADSTS50125 | PasswordResetRegistrationRequiredInterrupt - Sign-in was interrupted because of a password reset or password registration entry. |
| AADSTS50126 | InvalidUserNameOrPassword - Error validating credentials due to invalid username or password. The user didn't enter the right credentials. Expect to see some number of these errors in your logs due to users making mistakes. |
| AADSTS50170 | MissingExternalClaimsProviderMapping - The external controls mapping is missing. |
| AADSTS50171 | The given audience can only be used in Mutual-TLS token calls. |
| AADSTS50172 | External claims provider {provider} isn't approved. |
| AADSTS50173 | The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '{authTime}' and the TokensValidFrom date (before which tokens are not valid) for this user is '{validDate}'. To learn more, see the troubleshooting article for error [AADSTS50173](~/troubleshoot/entra/app-integration/error-code-aadsts50173-grant-expired-revoked.md). |
| AADSTS50176 | Missing definition of external control: {controlId}. |
| AADSTS50177 | ExternalChallengeNotSupportedForPassthroughUsers - External challenge isn't supported for passthrough users. |
| AADSTS50178 | SessionControlNotSupportedForPassthroughUsers - Session control isn't supported for passthrough users. |

MODIFIED docs/identity/hybrid/cloud-sync/gmsa-cloud-sync.md

Modified by Justinha on Sep 29, 2025 5:05 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Update Windows Server version requirements in docs

Changes:

Before

After

manager: mwongerapk
ms.service: entra-id
ms.topic: how-to
ms.date: 04/09/2025
ms.subservice: hybrid-connect
ms.author: jomondi
---
- The Active Directory schema in the gMSA domain's forest needs to be updated to Windows Server 2012 or later.
- [PowerShell RSAT modules](/windows-server/remote/remote-server-administration-tools) on a domain controller.
- At least one domain controller in the domain must be running Windows Server 2012 or later.
- A domain joined server where the agent is being installed needs to be either Windows Server 2016 or later.
 
 
## Permissions set on a gMSA account (ALL permissions)

manager: mwongerapk
ms.service: entra-id
ms.topic: how-to
ms.date: 09/29/2025
ms.subservice: hybrid-connect
ms.author: jomondi
---
- The Active Directory schema in the gMSA domain's forest needs to be updated to Windows Server 2012 or later.
- [PowerShell RSAT modules](/windows-server/remote/remote-server-administration-tools) on a domain controller.
- At least one domain controller in the domain must be running Windows Server 2012 or later.
- A domain-joined server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016 for the agent installation.
 
 
## Permissions set on a gMSA account (ALL permissions)

MODIFIED docs/identity/hybrid/cloud-sync/tutorial-basic-ad-azure.md

Modified by Justinha on Sep 29, 2025 5:05 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Update Windows Server version requirements in docs

Changes:

Before

After

 
## Prerequisites
The following are prerequisites required for completing this tutorial
- A computer with [Hyper-V](/windows-server/virtualization/hyper-v/hyper-v-technology-overview) installed. It's suggested to do this on either a [Windows 10](/virtualization/hyper-v-on-windows/about/supported-guest-os) or a [Windows Server 2016](/windows-server/virtualization/hyper-v/supported-windows-guest-operating-systems-for-hyper-v-on-windows) computer.
- An [external network adapter](/virtualization/hyper-v-on-windows/quick-start/connect-to-network) to allow the virtual machine to communicate with the internet.
- An [Azure subscription](https://azure.microsoft.com/free)
- A copy of Windows Server 2016
- [Microsoft .NET framework 4.7.1](https://dotnet.microsoft.com/download/dotnet-framework/net471)
 
> [!NOTE]

 
## Prerequisites
The following are prerequisites required for completing this tutorial
- A computer with [Hyper-V](/windows-server/virtualization/hyper-v/hyper-v-technology-overview) installed. It's suggested to do this on either a [Windows 10](/virtualization/hyper-v-on-windows/about/supported-guest-os) or a [Windows Server 2022](/windows-server/virtualization/hyper-v/supported-windows-guest-operating-systems-for-hyper-v-on-windows) computer.
- An [external network adapter](/virtualization/hyper-v-on-windows/quick-start/connect-to-network) to allow the virtual machine to communicate with the internet.
- An [Azure subscription](https://azure.microsoft.com/free)
- A copy of Windows Server 2022
- [Microsoft .NET framework 4.7.1](https://dotnet.microsoft.com/download/dotnet-framework/net471)
 
> [!NOTE]

MODIFIED docs/identity/hybrid/cloud-sync/tutorial-pilot-aadc-aadccp.md

Modified by Justinha on Sep 29, 2025 5:05 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Update Windows Server version requirements in docs

Changes:

Before

After

manager: mwongerapk
ms.service: entra-id
ms.topic: tutorial
ms.date: 04/09/2025
ms.subservice: hybrid-cloud-sync
ms.author: jomondi
ms.custom: sfi-image-nochange
 
- A test environment with Microsoft Entra Connect Sync version 1.4.32.0 or later
- An OU or group that is in scope of sync and can be used during the pilot. We recommend starting with a small set of objects.
- A server running Windows Server 2016 or later that will host the provisioning agent.
- Source anchor for Microsoft Entra Connect Sync should be either *objectGuid* or *ms-ds-consistencyGUID*
 
 

manager: mwongerapk
ms.service: entra-id
ms.topic: tutorial
ms.date: 09/29/2025
ms.subservice: hybrid-cloud-sync
ms.author: jomondi
ms.custom: sfi-image-nochange
 
- A test environment with Microsoft Entra Connect Sync version 1.4.32.0 or later
- An OU or group that is in scope of sync and can be used during the pilot. We recommend starting with a small set of objects.
- A server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016 to host the provisioning agent.
- Source anchor for Microsoft Entra Connect Sync should be either *objectGuid* or *ms-ds-consistencyGUID*
 
 

MODIFIED docs/identity/hybrid/cloud-sync/what-is-cloud-sync.md

Modified by Justinha on Sep 29, 2025 5:05 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Update Windows Server version requirements in docs

Changes:

Before

After

manager: mwongerapk
ms.service: entra-id
ms.topic: overview
ms.date: 04/09/2025
ms.subservice: hybrid-cloud-sync
ms.author: jomondi
 
| Support for federation |●|●|
| Seamless Single Sign-on|● |●|
| Supports installation on a Domain Controller |● |● |
| Support for Windows Server 2016|● |● |
| Filter on Domains/OUs/groups |● |● |
| Filter on objects' attribute values |● | |
| Allow minimal set of attributes to be synchronized (MinSync) |● |● |

manager: mwongerapk
ms.service: entra-id
ms.topic: overview
ms.date: 09/29/2025
ms.subservice: hybrid-cloud-sync
ms.author: jomondi
 
| Support for federation |●|●|
| Seamless Single Sign-on|● |●|
| Supports installation on a Domain Controller |● |● |
| Support for Windows Server 2022, Windows Server 2019, and Windows Server 2016|● |● |
| Filter on Domains/OUs/groups |● |● |
| Filter on objects' attribute values |● | |
| Allow minimal set of attributes to be synchronized (MinSync) |● |● |

MODIFIED docs/identity/hybrid/includes/gpad-prereqs.md

Modified by Justinha on Sep 29, 2025 5:05 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Update Windows Server version requirements in docs

Changes:

Before

After

author: omondiatieno
ms.service: entra-id
ms.topic: Include
ms.date: 08/01/2025
ms.author: jomondi
ms.custom: Include file
---
## General requirements
 
 - Microsoft Entra account with at least a [Hybrid Identity Administrator](../../role-based-access-control/permissions-reference.md#hybrid-identity-administrator) role.
 - On-premises AD DS environment with Windows Server 2016 operating system or later. 
   - Required for AD DS schema attribute - msDS-ExternalDirectoryObjectId 
 - Provisioning agent with build version [1.1.3730.0](../cloud-sync/reference-version-history.md#1113730) or later.
 

author: omondiatieno
ms.service: entra-id
ms.topic: Include
ms.date: 09/29/2025
ms.author: jomondi
ms.custom: Include file
---
## General requirements
 
 - Microsoft Entra account with at least a [Hybrid Identity Administrator](../../role-based-access-control/permissions-reference.md#hybrid-identity-administrator) role.
 - On-premises AD DS environment that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016. 
   - Required for AD DS schema attribute - msDS-ExternalDirectoryObjectId 
 - Provisioning agent with build version [1.1.3730.0](../cloud-sync/reference-version-history.md#1113730) or later.
 

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files