Tuesday, 30 September 2025

manager: mwongerapk

- The Active Directory schema in the gMSA domain's forest needs to be updated to Windows Server 2012 or later.

|Requirement|Description and more requirements|

To complete the tutorial, you need these items:

manager: mwongerapk

author: omondiatieno

The following are prerequisites required for completing this tutorial

manager: mwongerapk

1. Identify a server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016 to run Microsoft Entra Connect. If not enabled already, [enable TLS 1.2 on the server](./how-to-connect-install-prerequisites.md#enable-tls-12-for-azure-ad-connect). Add the server to the same Active Directory forest as the users whose passwords you need to validate. It should be noted that installation of Pass-Through Authentication agent on Windows Server Core versions isn't supported.

manager: mwongerapk

- Azure CLI

manager: mwongerapk

- Microsoft Entra Connect must be installed on a domain-joined server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016. We recommend Windows Server 2022. You can deploy Microsoft Entra Connect on Windows Server 2016. However, since Windows Server 2016 is in extended support, you might need [a paid support program](/lifecycle/policies/fixed#extended-support) if you require support for this configuration. Installing on unsupported versions of Windows Server may cause service failures or unexpected behavior.

| AADSTS50117 | Failed to deserialize policy specified in the request's claim parameter. |