Forum Discussion
The salt sizes required for signing with RSAPSS do not match those used by TPM.
Good evening everyone. I'm getting this error when I try to perform the first sync on my Windows Server 2022. I'm trying to sync the entire directory to manage my employees' licenses. I already have a tenant with users who can stay there without any problems. I had already synced the tenant with my old server in the past. For business reasons, the infrastructure has changed, and so has the server. In Entra ID, I don't see any old syncs, but in Admin Center, I do. Could this be the problem? Any advice is invaluable, as I'm at my wits' end.
2 Replies
That’s a tricky error, and you’re right to suspect it may be tied to the environment change rather than Entra ID itself. The message about “salt sizes required for signing with RSAPSS do not match those used by TPM” typically points to a mismatch between the cryptographic provider settings on the new server and what Entra (via Azure AD Connect / Entra Connect) expects.
A few things you might want to check:
🔑 TPM / Crypto provider – Confirm that the new server’s TPM and crypto libraries are correctly initialized. In some cases, enabling/disabling FIPS-compliant algorithms or using a different CSP can trigger this mismatch.
🔄 Clean up old sync objects – Even though you don’t see old syncs in Entra ID, residual objects in Microsoft Entra Connect Health or the Admin Center can cause conflicts. Removing the old sync instance completely (and re-registering the new one) often resolves this.
🗂️ Check certificate / key store – If custom certificates or keys were used with the previous sync, make sure the new server isn’t trying to reference stale keys. A full reconfiguration of Entra Connect usually forces a new key generation.
🛠️ Fresh install vs. re-use – If you migrated settings from the old server, try doing a clean install of Entra Connect on the new one instead of restoring configs. This ensures the crypto parameters are generated fresh and align with the TPM.
If you’re still stuck, I’d recommend opening a support case with Microsoft, since RSAPSS salt size mismatches are fairly low-level crypto issues — but in most migration cases, they come down to leftover sync objects or mismatched cryptographic providers on the new server.
I have having this same issue. It was working as of 09/01. Our server died, so I installed the server OS on a new device for DNS along with this software and it gives the RSAPSS / TPM error. Does anyone have advice?
Roberto, did you by chance install your server OS on a consumer desktop machine?
