Hey team, hope everyone is doing well.
Has anyone run into this issue with Microsoft Entra Cloud Sync before?
I have the Cloud Sync agent installed on a domain-joined VM. The agent services are running and the VM has normal internet access.
In Entra, the provisioning status shows:
HybridIdentityServiceAgentTimeout
I've checked the basics:
• VM is domain joined
• Logged in using a Domain Admin account
• DNS forwarding has been configured
• UPN suffix has been fixed
• Agent services are running, RSAT installed on DC
• No WinHTTP proxy
• login.microsoftonline.com:443 works
• login.windows.net:443 works
• management.azure.com:443 works
• autoupdate.msappproxy.net:443 works
• servicebus.windows.net:443 is failing
The firewall is a FortiGate. I'm looking at allowing *.servicebus.windows.net and *.msappproxy.net over TCP 443, with SSL inspection bypassed for those two endpoints.
Still no luck.
Any other bright ideas or things I should check? Has anyone had Cloud Sync working through a FortiGate and come across this exact timeout? We have recently moved towards Entra/Intune and this is our first site we are looking to Hybrid join.
Thanks!
Source: r/entra · by /u/Kaalvairaab