Forum Discussion

Ivane99's avatar
Ivane99
Copper Contributor
Oct 23, 2026

Microsoft Entra provisioning Agent Error

Hello,

 

I have deployed the Microsoft Entra provisioning agent in my organization, with synchronization configured from AD to Microsoft Entra ID. I am encountering an issue on the server where the Cloud Sync agent is installed: when connecting to Microsoft endpoints via a Squid proxy, I receive the error shown in the screenshot.

 

The synchronization itself works perfectly, and the configuration status in the cloud is "Healthy." I frequently see the error shown in the screenshot (error code 12015), and I also occasionally encounter error code 12011.

 

Has anyone experienced a similar issue? Could you please advise on how to resolve it?

 

Thanks.

 









































Administrator
Azure AD Connect
microsoft 365
microsoft entra
Provisioning

1 Reply

  • WinEndpointOps's avatar
    WinEndpointOps
    Brass Contributor
    Oct 24, 2026

    Since sync works and the config shows Healthy, these errors are most likely intermittent HTTP failures between the agent and the proxy, not a problem with the agent or the cloud config. Codes 12011 and 12015 are Windows internet (WinHTTP/WinINet) errors, and in a setup with Squid in the middle I would check:

     

    • Proxy authentication. If Squid asks for credentials, the agent service runs as its own service account (often a gMSA), and that account may not be able to answer the proxy challenge, so some requests fail while cached connections keep working. Best fix is to exempt the agent server, or the Microsoft endpoints it calls, from proxy authentication.
    • TLS inspection. If Squid is doing SSL bump or any HTTPS inspection, the agent can fail the certificate check on some calls. Bypass inspection for the Microsoft endpoints the agent uses.
    • The endpoint list. Make sure the full set from the Cloud Sync prerequisites is allowed through Squid (login.microsoftonline.com, the Service Bus and msappproxy endpoints, and the certificate revocation and CTL URLs). A missing CRL or OCSP URL causes errors that look random.
    • Proxy settings for the service. The agent reads its proxy from its own config file (AADConnectProvisioningAgent.exe.config, in the system.net defaultProxy section) and from the machine WinHTTP settings. Check both with netsh winhttp show proxy so they point to the same place.
    • Squid timeouts. Idle connection or read timeouts that are shorter than the agent's long polling will show up as these errors from time to time. Compare the times of the events with the Squid access and cache logs.

    If the agent keeps syncing and the status stays Healthy, these are warnings the agent retries on its own, but fixing the proxy path will remove the noise and prevent real outages.