Low severityauthentication
Power BI Error:
AADSTS80007
What does this error mean?
Microsoft Entra ID (Azure AD) Pass-through Authentication Agent failed to validate the user's password against on-prem Active Directory.
Common causes
- 1Pass-through Authentication Agent service stopped or crashed on the host server
- 2Network/firewall blocking outbound 443 from the PTA Agent to *.msappproxy.net or inbound LDAP/Kerberos to domain controllers
- 3All reachable domain controllers are down, unreachable, or returning errors
- 4Time skew (>5 minutes) between PTA Agent host and domain controllers breaking Kerberos
- 5Account lockout, disabled account, or expired password in on-prem Active Directory
How to fix it
- 1On the server running the Microsoft Entra Connect Authentication Agent, open Event Viewer → Applications and Services Logs → Microsoft → AzureAdConnect → AuthenticationAgent → Admin and locate the failure event matching the sign-in timestamp.
- 2Verify the 'Microsoft Entra Connect Authentication Agent' service is running; restart it and confirm the agent shows 'Active' under Entra admin center → Hybrid management → Microsoft Entra Connect → Pass-through authentication.
- 3From the agent host, test connectivity to the nearest domain controller (`nltest /sc_query:<domain>`, `Test-NetConnection <DC> -Port 389`) and validate AD health (`dcdiag`, replication, time sync via `w32tm /query /status`).
- 4Confirm the affected user account in AD is enabled, not locked out, and password is not expired (`Get-ADUser <user> -Properties LockedOut,Enabled,PasswordExpired`).
- 5Deploy a second PTA Agent on a different server for redundancy so a single agent failure no longer causes AADSTS80007 storms.