Microsoft Certified: Azure Administrator AssociateImplement and manage hybrid identitiesHard
A company has implemented Azure AD Connect with Pass-through Authentication (PTA). Users are reporting intermittent authentication failures to cloud applications. You check the Azure AD Connect Health portal and see that one of the PTA agents is showing an 'Inactive' status. What is the most immediate action you should take to resolve the issue for the affected agent?
- ARestart the Azure AD Connect synchronization service on the main server.
- BVerify the service account permissions for the PTA agent.
- CCheck the network connectivity from the server hosting the inactive PTA agent to Azure AD.
- DReinstall the PTA agent on the affected server.
Show answer & explanationAnswer & explanation
Correct answer: C. Check the network connectivity from the server hosting the inactive PTA agent to Azure AD.
An 'Inactive' status for a PTA agent most commonly indicates a loss of connectivity to Azure AD. The most immediate and logical step is to check the network connection from that server to ensure it can reach Azure AD endpoints.
Why the other options are wrong
- A. Restarting the Azure AD Connect synchronization service affects identity synchronization, not directly the PTA agent's operational status.
- B. Incorrect service account permissions might prevent the agent from starting or functioning correctly, but 'Inactive' often points to a communication issue first. This would be a secondary step if connectivity is confirmed.
- D. Reinstalling the agent is a more drastic step and should be considered after basic troubleshooting like network connectivity and service status checks.
PTA Agent Inactive Status
When an Azure AD Pass-through Authentication agent is unable to communicate with Azure AD, resulting in it being marked as 'Inactive' in Azure AD Connect Health.
- Commonly caused by network connectivity issues (firewall, proxy, DNS).
- Can also be due to the agent service being stopped or unhealthy.
- Requires investigation of the server hosting the agent.
Memory trick: Inactive agent? First, check its 'lifeline' to the cloud.