"Unfortunately, it looks like we can't connect to your on-premises writeback client right now. Troubleshoot Microsoft Entra Connect to restore the connection"

Kyuss Hala 0 Reputation points
2026-08-06T20:06:31.75+00:00

This error still persists even though:

  • I have given the connector service account all privileges & access it needs.
  • I've updated AD Connect from the local on-prem server.
  • M365 Admin Center shows syncs are successful.
  • Synchronization Service Manager shows syncs are successful.
  • Password Hash and Writeback are enabled on AD Connect.

I'm not sure what else to try here.

User's image

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Kyuss Hala 0 Reputation points
    2026-08-06T20:56:05.7833333+00:00

    Issue resolved. I just had to wait it seems.

    Was this answer helpful?

    0 comments
  2. Kyuss Hala 0 Reputation points
    2026-08-06T20:12:27.1533333+00:00

    I've restarted the sync service, no resolution.

    I've verified it's not a network issue.

    The logs are: "TrackingId: 2a72b5fa-938f-4f23-97e0-b64dd0c14d03, Listener for Namespace: ssprdedicatedsbprodncu-2, Endpoint: 8acf665a-66c3-4c79-9e23-db4ec7f491dc_edbb4c56-5635-4073-bb92-c968a385df62 offline Event. Last error encountered , Details: Version: 6.0.210.1" for event ID 31034. 31019 doesn't show any errors.
    I've disabled and re-enabled password writeback, no resolution.
    I've re-installed the AD Connect, no resolution.
    The AD Connector account has correct permissions.

    Was this answer helpful?

    0 comments

  3. AI answer

    2026-08-06T20:06:57.7933333+00:00

    The next checks should focus on writeback connectivity rather than normal directory sync, because successful sync in Microsoft 365 Admin Center and Synchronization Service Manager does not by itself confirm that the password writeback channel is healthy.

    1. Restart the Microsoft Entra Connect Sync service.
      • On the server running Microsoft Entra Connect, open services.msc.
      • Find Azure AD Sync.
      • Right-click it and select Restart.
      • This re-establishes the connection with Microsoft Entra ID and is the first recommended recovery step for writeback connectivity issues.
    2. Verify outbound HTTPS access from the Entra Connect server.
      • For Microsoft Entra Connect version 1.1.443.0 and later, password writeback requires outbound HTTPS access to:
        • *.passwordreset.microsoftonline.com
        • *.servicebus.windows.net
      • If using Azure Government or Azure China, the required endpoints differ.
      • Firewall, proxy, or idle timeout issues are called out as the most common cause.
    3. Check Event Viewer for writeback connectivity errors.
      • On the Entra Connect server, open Event Viewer.
      • Go to Windows Logs > Application.
      • Look for event IDs 31034 or 31019.
      • These events can identify the service bus listener involved and help confirm whether URL or port access is being blocked.
    4. Disable and then re-enable password writeback in the Microsoft Entra Connect Configuration wizard.
      • Open Microsoft Entra Connect Configuration wizard as an administrator.
      • Sign in with Microsoft Entra Hybrid Administrator credentials.
      • Sign in to AD DS with on-premises AD DS admin credentials.
      • On Optional features, clear Password writeback.
      • Continue through the wizard to Ready to configure, confirm it shows password writeback as disabled, and select Configure.
      • On Finished, clear Synchronize now, then select Finish.
      • Reopen the wizard and repeat the process, this time enabling Password writeback again.
    5. If the issue still persists after that, update to the latest Microsoft Entra Connect release with an in-place upgrade.
      • Warning: if custom out-of-box sync rules were modified, back them up before upgrading and manually redeploy them afterward.
      • Download the latest version from the Microsoft Entra Admin Center and run the installer as an in-place upgrade.
    6. If permissions were granted manually, verify the actual AD DS connector account being used before changing anything else.
      • In Synchronization Service Manager > Connectors > select the AD connector > Properties > Connect to Active Directory Forest.
      • Confirm the User name shown there is the connector account that received the writeback permissions.
    7. If the environment has more than one Entra Connect server, check whether a second server is active with the same settings.
      • A documented case with this exact symptom was resolved by putting the second Entra Connect server into staging mode, because two Entra Connect services with the same settings were causing the issue.

    Based on the screenshot, one additional check is important:

    • If Microsoft Entra Connect Sync is being used and cloud sync is not deployed, review the setting Write back passwords with Microsoft Entra Connect cloud sync.
    • A moderator-recommended resolution for the same symptom was to clear that setting, because it can remain enabled by default even when Cloud Sync is not actually set up.

    A practical order to try is:

    1. Restart Azure AD Sync.
    2. Verify outbound HTTPS to the required password reset and service bus endpoints.
    3. Check Event Viewer for 31019/31034.
    4. Clear the cloud sync password writeback option if Cloud Sync is not in use.
    5. Disable/re-enable Password writeback in the wizard.
    6. Confirm only one active Entra Connect server is handling the configuration.
    7. Perform an in-place upgrade to the latest release if not already done.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.