Sync agent stops with Error 5 Access Denied after internet outage
Cloud sync agent services on domain controllers fail with an Error 5 Access Denied message following a network interruption. This blocks synchronization and requires adding the group managed service account to the built-in Administrator group to restore functionality.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
- 1Add the service account to the built-in Administrator group in Active Directory
- 2Move the synchronization agent to a member server instead of a domain controller
- 3Spun up an internal bridge to coordinate responses.
In their words
Unedited, most upvoted first, each linked to the thread it came from.
“Anyone experiencing issues accessing Azure or Office portals?”source ↗
“So, I had the cloud sync agent working for about 8 months or so. Yesterday, there was an internet outage, and both agent (on 2 DCs) services stopped working (each agent on each DC). The service would not run- Error 5: Access Denied.”source ↗
“The only thing that works is to add the gmsa to the built-in Administrator group in AD.”source ↗
“Seeing this as well, SSO issues from this.”source ↗
“Yup, getting 503 errors when trying to auth into any O365 service or admin center.”source ↗
“We're seeing some too, just spun up an internal bridge but its sounding like a bigger issue than just us.”source ↗
“We're having the same issue - lots of SSO issues, 503, Bad Gateway, etc.”source ↗
Where this came up
People with this problem also raised
- 4Locked out of new network switches because the consultant left
- 7Why am I getting DMARC and SPF errors when emails deliver fine?
- 4Windows 10 error adding Windows 11 network printers
- 13Why do Microsoft software updates and account errors break everything?
- 3Server randomly rebooting with no error logs or dumps
- 2How to open old Microsoft Publisher .pub files