How to reset seamless SSO kerberos key ?

Question

How to reset seamless SSO kerberos key ?

Lin 20

Hi team

Users on domain-joined devices are repeatedly prompted for credentials when accessing Entra-integrated SaaS applications. Domain logs show KRB_AP_ERR_MODIFIED errors targeting the AZUREADSSOACC computer account.

How do we reset the Seamless SSO Kerberos decryption key ?

0 comments

1 answer

Your answer

Answer 1

Hello,

the repeated KRB_AP_ERR_MODIFIED errors against the AZUREADSSOACC account confirm that the Kerberos decryption key used for Seamless SSO is out of sync between your on‑premises AD and Azure AD. This happens when the computer account password for AZUREADSSOACC has changed locally but the corresponding key in Azure AD was not updated, or vice versa. The fix is to reset and re‑publish the Seamless SSO Kerberos key.

The supported way to do this is with the Azure AD Connect PowerShell module. On a domain‑joined machine with the Azure AD Connect agent installed, open an elevated PowerShell session and run:

powershell

Import-Module AzureADSSO
New-AzureADSSOAuthenticationContext
Update-AzureADSSOForest -Domain <yourdomain.com>

The New-AzureADSSOAuthenticationContext cmdlet will prompt you to authenticate with a Global Administrator account in Entra ID. Once authenticated, Update-AzureADSSOForest regenerates the Kerberos decryption key for the AZUREADSSOACC account in your AD forest and synchronizes it with Azure AD. This effectively resets the key and resolves the mismatch that is causing the KRB_AP_ERR_MODIFIED errors.

After running the update, allow replication to complete across your domain controllers. You can verify the fix by checking the Event Viewer → Applications and Services Logs → Microsoft → Windows → Kerberos/Key Distribution Center for successful ticket issuance, and by testing access to Entra‑integrated SaaS apps from a domain‑joined client. The repeated credential prompts should stop once the key is synchronized.

If you have multiple forests configured for Seamless SSO, you must run Update-AzureADSSOForest for each one. Also ensure that the AZUREADSSOACC account is not manually modified in AD; its password is managed exclusively by Azure AD Connect.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

DV