New Intune Connector for Active Directory Process Not Working

I can see this isn't just me...................

Any word from Microsoft. Followed the docs to the letter and this is still coming up.........

Also try Enterprise admin permission as I have more success configuring mine even though it's not documented.

I also have this issue. Did you get anywhere?

Same issue. Very frustrating. IMO, Microsoft needs to abandon this effort. In our test environment it doesn't work. In production I don't know how we are going to do it as we don't have an account with that level of on prem access + Intune admin. Goes against all MS security best practice :/

Met with client today - they opened a ticket with MSFT - no response or answer yet. Today we validated internet access and all the other pre-req's.

We uninstalled a number of times and reinstalled with no change. I am feeling like the recreation of that managed service folder has something to do with it. The other thing we noticed is if we go on a browser on the server to https://manage.microsoft.com we get prompted for 2FA but we do not get prompted when trying to log in on the server.

Very frustrating.

Known issues with the Intune Connector for AD version 6.2501.2000.5

Date added: April 8, 2025

The following issues are under active investigation:

Error MSA account <accountName> is not valid when signing in.

This error occurs when the connector successfully creates the MSA but fails to retrieve the data from the domain controller. Various issues can cause the error, including replication delays between domain controllers in single domain, or when the user account exists in a different domain to the connector machine.

Error Failed to create a managed service account - Element not found.

Error Cannot start service ODJConnectorSvc on computer '.'. ---> System.ComponentModel.Win32Exception: The service did not start due to a logon failure after the MSA is created.

This error occurs when the service can't run as the MSA. The service not being able to run as the MSA can be caused by various issues, including group or local policy restricting Log on as a service privileges.

Error System.DirectoryServices.DirectoryServicesCOMException (0x8007202F): A constraint violation occurred.

There is a known issue reported https://learn.microsoft.com/en-us/autopilot/known-issues

Yea, I opened a case yesterday. The engineer mentioned that there were known issues and collected the log. This is in a test environment. Not sure what we're going to do in production where no accounts have on prem access to create MSA's and cloud Intune Admin....and our Identity team says 'that goes against our security processes and procedures'... I wish they would just keep the old tool until they simply dump hybrid join Autopilot support - it can't be very long since Microsoft stopped investing in it over a year ago..........

Its something to do with "OtherWellKnownObjects" GUID mismatch. When you re-create the MSA container the "OtherWellKnownObjects" GUID is still pointing to the previously deleted MSA container.

• @Nirmal Makadia Good call. Did a quick Google Search and found this: https://learn.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/exchange-security-update-issues#exchange-setup-or-preparead-error

Will have client try the recommended PowerShell script and try again.

I've been hitting my head against the wall with this exact error message for the past month now and reading Nirmal's comment last week has helped out tremendously. I too have an environment where I needed to recreate the MSA CN and I was getting the same error, "element not found", when trying to run the installer. After reading Nirmal's comments I looked into it and found exactly that, the GUID was set to the old deleted container and not the new one.

Here is what I did to solve that (for others in the future):

#This will give you what the current GUID is of the new MSA CN you created 
$DomainDN = "DC=your,DC=domain" 
$MSAContainer = Get-ADObject -Filter {Name -eq "Managed Service Accounts"} -SearchBase $DomainDN 
$MSAContainer.ObjectGUID  

#This will give you a list of all "OtherWellKnownObjects" so that you can see whats been deleted. In my case I was able to see "B:32:1EB93889E40C45DF9F0C64D23BBB6237:CN=Managed Service Accounts\0ADEL:67756e44-b23d-4c77-a0cd-4d36346349fc,CN=Deleted Objects,DC=my,DC=domain" 
$DomainRoot = Get-ADObject -Identity $DomainDN -Properties OtherWellKnownObjects
$DomainRoot.OtherWellKnownObjects | FL  

# Get the GUID of the NEW MSA container and change it to all uppercase (to match the formatting it should be) 
$NewMSAGuid = $MSAContainer.ObjectGUID.Guid.ToUpper()

# Remove hyphens from the GUID (AD format) 
$NewMSAGuidADFormat = $NewMSAGuid.Replace("-", "")

# Update the OtherWellKnownObjects attribute. You can call the variables but I chose to enter in the values myself just to be extra sure. You will also need to run this portion as Administrator on the DC so make sure you launch powershell as admin. 
Set-ADObject -Identity "DC=your,DC=domain" -Replace @{
    OtherWellKnownObjects = "PUT_THE_GUID_HERE:CN=Managed Service Accounts,DC=your,DC=domain"
}

This solved my error and now I've got a new one to tackle (yay! .. sigh):

"Failed to create a managed service account - The filename, directory name, or volume label syntax is incorrect"

If you find anything about this do let me know :)

Entered your error in Copilot and got this:
This error typically occurs when setting up the Intune Connector for Active Directory, often due to issues with the Managed Service Account (MSA) or incorrect directory paths. Here are a few troubleshooting steps:

Possible Causes & Fixes

Verify the Managed Service Account (MSA) OU

• Ensure the MSA Organizational Unit (OU) exists in Active Directory.
  • Check that the connector has the correct permissions to create accounts in this OU.
  Check Directory & Volume Label Syntax

  - Confirm that no invalid characters are present in the directory path.
  
     - Ensure the system drive and volume labels are correctly formatted.
  
     **Review Event Logs & Connector Logs**
  
        - Open **Event Viewer** and check logs under **Applications and Services Logs > Microsoft > Windows > IntuneODJConnector**.
  
           - Look for specific errors related to account creation.
  
           **Validate Service Account Permissions**
  
              - Ensure the account running the connector has **Create/Delete Managed Service Account** permissions in Active Directory.
  
                 - If necessary, temporarily assign **Domain Admin** rights to test.
  
                 **Reinstall the Intune Connector**
  
                    - Uninstall and reinstall the **Intune Connector for Active Directory** to reset configurations.
  

If the issue persists, you might find additional insights in this Microsoft Q&A thread discussing similar problems. Let me know if you need help troubleshooting further!