← cd ~/events
// events/906 · Entra Connect
Event ID 906MSAL token acquisition via certificate failed
Entra Connect Sync could not authenticate with application-based authentication, for example AADSTS700027 when two sync servers share the same Entra connector account or a server was cloned.
| Log | Application |
|---|---|
| Source | Directory Synchronization |
| Area | Entra Connect |
What to check
Give each Connect server its own connector account and application registration, then run Repair-ADSyncToolsEntraAppParameters or the wizard.
Codes you'll see in this event
| Code | Meaning |
|---|---|
AADSTS700027 | Certificate used to sign the client assertion is not registered on the application. |
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Id = 906 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Application log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Application" and EventID == 906
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Entra Connect events
- Event ID 601: Password hash sync manager starting
- Event ID 607: Password hash sync could not start
- Event ID 609: Password hash sync stopped
- Event ID 611: Error during password hash sync for a domain
- Event ID 613: Paused: full sync not completed
- Event ID 616: Connection to preferred DC failed
- Event ID 617: Full password hash sync started for forest
- Event ID 621: Full password hash sync attempt failed