📋 Microsoft Entra Documentation Changes

## Known issue: Synchronization fails after upgrade if miiserver.exe.config was previously modified

Applies to

- Microsoft Entra Connect 2.5.190.0

- Microsoft Entra Connect 2.6.1.0

### Issue

After upgrading Microsoft Entra Connect, synchronization may fail if the `miiserver.exe.config` file was previously modified.

 

### Symptom

 

 

`Synchronization fails after upgrade with the following error: System.IO.FileLoadException: Could not load file or assembly 'System.Diagnostics.DiagnosticSource, Version=6.0.0.1'

or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)`

 

 

### Cause

 

During upgrade, Microsoft Entra Connect detects that `miiserver.exe.config` has been modified and does not update the file. This results in a missing dependency binding required for synchronization.

An [agent identity blueprint](agent-blueprint.md) is used to create agent identities and request tokens using those agent identities. During the process for creating an agent identity blueprint, you set the [owner and sponsor](agent-owners-sponsors-managers.md) of that blueprint, to establish accountability and administrative relationships. You also configure an identifier URI and define a scope for agents created from this blueprint if the agent is designed to receive incoming requests from other agents and users.

- [Privileged Role Administrator](../../identity/role-based-access-control/permissions-reference.md#privileged-role-administrator) role is required to grant Microsoft Graph Application permissions.

- [Cloud Application Administrator](../../identity/role-based-access-control/permissions-reference.md#cloud-application-administrator) or [Application Administrator](../../identity/role-based-access-control/permissions-reference.md#application-administrator) is required to grant Microsoft Graph delegated permissions.

- If using PowerShell, version 7 is required.

- In preview, all operations with the agent identity blueprint require the beta version for both Microsoft Graph and PowerShell.

In this article, you use Microsoft Graph PowerShell or another client to create your agent identity blueprint. You must authorize this client to create and configure an agent identity blueprint and create an agent identity blueprint principal. The client requires the following Microsoft Graph permissions:

* US Production data center: `https://servicesapp2.clarizen.com/scim/v2`

* EU Production data center: `https://serviceseu1.clarizen.com/scim/v2`

* US Sandbox data center: `https://servicesapp.clarizentb.com/scim/v2`

* EU Sandbox data center: `https://serviceseu.clarizentb.com/scim/v2`

1. Open the Abstract web app.

1. Open the Abstract web app.

3. Select **Test with my Account**. If the test fails, please contact the Abstract support team.

> The Sign-On URL value isn't real. Update the value with the actual Sign-On URL. Contact Achieve3000 Client support team to get the value. You can also refer to the patterns shown in the **Basic SAML Configuration** section.

To configure single sign-on on **Achieve3000** side, you need to send the downloaded **Federation Metadata XML** and appropriate copied URLs from the application configuration to Achieve3000 support team. They set this setting to have the SAML SSO connection set properly on both sides.

In this section, you create a user called B.Simon in Achieve3000. Work with Achieve3000 support team to add the users in the Achieve3000 platform. Users must be created and activated before you use single sign-on.

> These values aren't real. Update these values with the actual Sign-on URL, Identifier and Reply URL. Contact Concur Client support team to get these values. You can also refer to the patterns shown in the **Basic SAML Configuration** section.

To configure single sign-on on **Concur** side, you need to send the downloaded **Federation Metadata XML** and appropriate copied URLs from the application configuration to Concur support team. They set this setting to have the SAML SSO connection set properly on both sides.

> The configuration of your Concur subscription for federated SSO via SAML is a separate task, which you must contact Concur Client support team to perform.

> These values aren't real. Update these values with the actual Sign-On URL, Identifier and Reply URL. Contact Form.com Client support team to get these values. You can also refer to the patterns shown in the **Basic SAML Configuration** section.

To configure single sign-on on **Form.com** side, you need to send the downloaded **Certificate (Base64)**, **App Federation Metadata Url** and appropriate copied URLs from the application configuration to Form.com support team. They set this setting to have the SAML SSO connection set properly on both sides.

In this section, you create a user called Britta Simon in Form.com. Work with Form.com support team to add the users in the Form.com platform. Users must be created and activated before you use single sign-on.

> These values aren't real. Update them with the actual Identifier,Reply URL and Sign on URL of the base URL of your Lenses portal instance. See the Lenses.io SSO documentation for more information.

To configure SSO on the **Lenses.io** portal, install the downloaded **Federation Metadata XML** on your Lenses instance and configure Lenses to enable SSO.

For more information, see Azure - Lenses group mapping.

> These values are placeholders. Update these values with the actual Identifier and Sign on URL. Contact the Predictix Ordering support team to get the values. You can also refer to the patterns shown in the **Basic SAML Configuration** dialog box.

To configure single sign-on on the Predictix Ordering side, you need to send the certificate that you downloaded and the URLs that you copied to the Predictix Ordering support team. This team ensures the SAML SSO connection is set properly on both sides.

Next, you need to create a user named Britta Simon in Predictix Ordering. Work with the Predictix Ordering support team to add users. Users need to be created and activated before you use single sign-on.

1. Ensure the "Tenant URL" section is populated with the correct endpoint: `https://scim.workplace.com/`. Under the **Admin Credentials** section, select **Authorize**. You're redirected to Workplace from Meta's authorization page. Input your Workplace from Meta username and select the **Continue** button. Select **Test Connection** to ensure Microsoft Entra ID can connect to Workplace from Meta. If the connection fails, ensure your Workplace from Meta account has Admin permissions and try again.

> Failure to change the URL to `https://scim.workplace.com/` results in a failure when trying to save the configuration

1. Update the tenant URL in the Admin Credentials section to the following URL: `https://scim.workplace.com/`