Forum Discussion

RB_IT's avatar
RB_IT
Occasional Reader
Sep 01, 2026

Weird Issue with Entra Connect -Cloud Sync HybridIdentityServiceAgentTimeout

Hey team, hope everyone is doing well.

Has anyone run into this issue with Microsoft Entra Cloud Sync before?

I have the Cloud Sync agent installed on a domain-joined VM. The agent services are running and the VM has normal internet access.

 

In Entra, the provisioning status shows:

HybridIdentityServiceAgentTimeout

 

I've checked the basics:

• VM is domain joined

• Logged in using a Domain Admin account

• DNS forwarding has been configured

• UPN suffix has been fixed

• Agent services are running, RSAT installed on DC

• No WinHTTP proxy

• login.microsoftonline.com:443 works

• login.windows.net:443 works

• management.azure.com:443 works

• autoupdate.msappproxy.net:443 works

• servicebus.windows.net:443 is failing

 

The firewall is a FortiGate. I'm looking at allowing *.servicebus.windows.net and *.msappproxy.net over TCP 443, with SSL inspection bypassed for those two endpoints.

Still no luck.

Any other bright ideas or things I should check? Has anyone had Cloud Sync working through a FortiGate and come across this exact timeout? We have recently moved towards Entra/Intune and this is our first site we are looking to Hybrid join.

 

Thanks!

1 Reply

  • Jamony's avatar
    Jamony
    MCT
    Sep 02, 2026

    Your Cloud Sync agent is running locally, but the timeout and failed Service Bus test point to outbound communication rather than domain join or administrator rights. On FortiGate, allow TCP 443 to the complete resolved destinations behind *.servicebus.windows.net and *.msappproxy.net, including CNAME chains, and exclude those flows from TLS inspection, certificate substitution, authentication, and application proxying. Do not pin one IP because endpoints can change. Test name resolution and TCP connectivity from the agent server under the service context, not only an interactive administrator session. Check the provisioning agent traces under C:\ProgramData\Microsoft\Azure AD Connect Provisioning Agent\Trace and export an AADCloudSyncTools log bundle immediately after reproducing the timeout. Finally, confirm the agent becomes healthy in the Entra admin center. If TCP 443 works but registration still times out, capture FortiGate deny and TLS logs and open Microsoft support with the exact UTC correlation time.