entra connect health sync agent stops updating cloud dashboards after TLS inspection and proxy authentication

Hello @Pradeep Singh Arora

The combination of HTTP 407 Proxy Authentication Required and CERT_AUTHORITY_INVALID strongly points to the corporate proxy/TLS inspection path, not an Entra Connect synchronization issue.

Microsoft specifically notes that the Microsoft Entra Connect Health agent registration or data-upload operations can fail when outbound traffic undergoes TLS inspection or termination. The agent also requires outbound access to specific Microsoft Entra Connect Health endpoints.

I would first check the Health agent's current proxy configuration:

Get-MicrosoftEntraConnectHealthProxySettings

If the server should use your corporate proxy, configure the Health agent using its supported proxy cmdlet, for example:

Set-MicrosoftEntraConnectHealthProxySettings `
    -HttpsProxyAddress proxy.contoso.com:8080
Restart-Service AzureADConnectHealthAgent*

You can also import the existing WinHTTP configuration:

Set-MicrosoftEntraConnectHealthProxySettings -ImportFromWinHttp
Restart-Service AzureADConnectHealthAgent*

Microsoft notes that configuring the agent simply through netsh winhttp set proxy isn't the supported method because the Health agent uses System.Net rather than WinHTTP.

The 407 error is also important. Microsoft documents 407 as the proxy requiring authentication when appropriate credentials aren't being supplied. For the Connect Health agent specifically, authenticated proxies using HTTP Basic aren't supported.

Given your environment uses TLS inspection, I would have the network/security team verify that the required Connect Health destinations aren't being blocked or that their TLS sessions aren't being terminated. Required endpoints include:

*.aadconnecthealth.azure.com

*.adhybridhealth.azure.com

*.blob.core.windows.net

*.servicebus.windows.net

login.microsoftonline.com

login.windows.net

management.azure.com

aadcdn.msftauth.net

aadcdn.msauth.net

Microsoft's current documentation explicitly warns that TLS inspection/termination can cause Health agent registration and data-upload failures.

After correcting the proxy/TLS path, restart the agents and test connectivity:

Restart-Service AzureADConnectHealthAgent*
Test-MicrosoftEntraConnectHealthConnectivity

If connectivity succeeds, allow some time for fresh telemetry to appear in the Entra Connect Health dashboard.

I wouldn't reinstall Entra Connect or the Health agent yet. With 407 plus certificate-authority validation errors, I'd resolve the proxy authentication and TLS-inspection path first.

Sharing these references with you:

Install and configure Microsoft Entra Connect Health agents

Troubleshoot Microsoft Entra Connect connectivity issues

Please "Accept the Answer" if this information helped you. This will help us and others in the community.