What causes AADSTS80005?

Pass-through Authentication Agent service (AzureADConnectAuthenticationAgentService) is stopped, crashed, or in a degraded state on the on-prem server. PTA Agent host cannot reach a writable domain controller (firewall, DNS, or LDAP/Kerberos port blocked). Outbound connectivity from the PTA Agent to *.msappproxy.net / Azure Service Bus (ports 443/80) is blocked or proxied incorrectly. Outdated PTA Agent version with known WCF/exception-handling bugs (upgrade to the latest agent). Transient failure inside the Authentication Agent (timeout, TLS handshake, or unhandled exception in the validator pipeline)

How do I fix AADSTS80005?

On every server running the Pass-through Authentication Agent, verify the 'Microsoft Entra Connect Authentication Agent' service is running and restart it; check the Application event log for exceptions from source 'AzureADConnectAuthenticationAgentService'. In the Microsoft Entra admin center → Hybrid management → Pass-through authentication, confirm all registered agents show status 'Active'; deploy a second agent for HA if only one exists. From the agent host, validate outbound HTTPS to *.msappproxy.net and Azure Service Bus, and verify LDAP/Kerberos reachability to a writable domain controller (test with nltest /dsgetdc and a test bind). Upgrade the PTA Agent to the latest version (older builds have known unhandled-exception bugs that surface as AADSTS80005) and re-register if needed. If the error persists after agent restart and connectivity checks, collect the agent trace logs from %ProgramData%\Microsoft\Azure AD Connect Authentication Agent\Trace and open a Microsoft support ticket — this code explicitly indicates an exception Microsoft needs to inspect

Low severityauthentication

Power BI Error:
AADSTS80005

What does this error mean?

Pass-through Authentication (PTA) Agent returned an unhandled exception while validating on-premises AD credentials.

Common causes

1Pass-through Authentication Agent service (AzureADConnectAuthenticationAgentService) is stopped, crashed, or in a degraded state on the on-prem server
2PTA Agent host cannot reach a writable domain controller (firewall, DNS, or LDAP/Kerberos port blocked)
3Outbound connectivity from the PTA Agent to *.msappproxy.net / Azure Service Bus (ports 443/80) is blocked or proxied incorrectly
4Outdated PTA Agent version with known WCF/exception-handling bugs (upgrade to the latest agent)
5Transient failure inside the Authentication Agent (timeout, TLS handshake, or unhandled exception in the validator pipeline)

How to fix it

1On every server running the Pass-through Authentication Agent, verify the 'Microsoft Entra Connect Authentication Agent' service is running and restart it; check the Application event log for exceptions from source 'AzureADConnectAuthenticationAgentService'
2In the Microsoft Entra admin center → Hybrid management → Pass-through authentication, confirm all registered agents show status 'Active'; deploy a second agent for HA if only one exists
3From the agent host, validate outbound HTTPS to *.msappproxy.net and Azure Service Bus, and verify LDAP/Kerberos reachability to a writable domain controller (test with nltest /dsgetdc and a test bind)
4Upgrade the PTA Agent to the latest version (older builds have known unhandled-exception bugs that surface as AADSTS80005) and re-register if needed
5If the error persists after agent restart and connectivity checks, collect the agent trace logs from %ProgramData%\Microsoft\Azure AD Connect Authentication Agent\Trace and open a Microsoft support ticket — this code explicitly indicates an exception Microsoft needs to inspect

Frequently asked questions

What does AADSTS80005 mean?

OnPremisePasswordValidatorUnpredictableW

How do I fix this error?

Check your application registration, token configuration, and user permissions in the Azure portal. Review Conditional Access policies if the error is policy-related.

Source · learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes#aadsts-error-codes