Question

Your organization uses Microsoft Entra Connect with password hash synchronization and has enabled Seamless Single Sign-On (Seamless SSO). Security policy requires that the Kerberos decryption key used by the AZUREADSSOACC computer account be rolled over every 30 days. You need to perform this rollover while minimizing the risk of sign-in disruption for users. What should you do?

Accepted Answer

On the Entra Connect server, import the Seamless SSO PowerShell module and run Update-AzureADSSOForest after authenticating with a Domain Administrator account.

Answer

Reset the AZUREADSSOACC computer account password in Active Directory Users and Computers, then restart the Entra Connect server.

Answer

Disable and re-enable Seamless SSO from the Entra Connect wizard, which automatically generates a new key.

Answer

Delete the AZUREADSSOACC computer account and rerun the Entra Connect configuration wizard to recreate it.