Question

Your organization uses Microsoft Entra Connect with Seamless Single Sign-On (SSSO) enabled for a single Active Directory forest. Security has mandated that the AZUREADSSOACC computer account in on-premises AD have its Kerberos decryption key rotated on a regular schedule as a hardening measure. You need to roll over the key without disrupting user sign-ins, and you want to perform this using the supported tooling. Which action should you take?

Accepted Answer

Run the PowerShell cmdlet Update-AzureADSSOForest against the AZUREADSSOACC account using the Seamless SSO PowerShell module on the Entra Connect server

Answer

Delete and recreate the AZUREADSSOACC computer object manually in Active Directory Users and Computers

Answer

Reset the AZUREADSSOACC computer account password in the on-premises AD and let it replicate to Entra automatically

Answer

Disable and re-enable Seamless SSO in the Entra Connect wizard, which regenerates the account each time