Category archive
Published troubleshooting guides for identity & access issues.
Fix Entra Connect Sync still exporting to the old tenant after migration by checking connector targets, sync server role, credentials, and stale staging-server cutover steps.
Fix Okta SCIM provisioning still sending users to the old endpoint after migration by checking app integration settings, auth credentials, push mappings, and stale provisioning templates.
Fix classic Kerberos constrained delegation still targeting the old service SPN after migration by checking allowed delegation targets, SPN registration, service accounts, and stale configuration.
Fix RD Gateway authentication still using the old NPS policy server after migration by checking CAP or RAP policy, RADIUS settings, certificates, and stale gateway integration.
Fix smart card logon still validating against the old CA after migration by checking NTAuth, domain trust stores, CRL or AIA paths, and stale certificate mapping policy.
Fix AD FS traffic still traversing the old Web Application Proxy after migration by checking federation service names, proxy trust, relying party endpoints, and stale DNS or load balancer paths.
Fix SSH sessions still traversing the old bastion after migration by checking ProxyJump, ssh_config includes, access wrappers, and stale admin routing policy.
Fix 802.1X authentication still using the old policy server after migration by checking switch AAA config, RADIUS groups, certificates, and stale NAC policy.
Fix admin access still opening the old bastion after migration by checking saved shortcuts, SSH config, RDP profiles, and stale privileged access workflow settings.
Fix services still failing gMSA password retrieval after migration by checking domain controller discovery, SPNs, KDS roots, and stale service account dependencies.
Fix Windows or Office clients still activating against the old KMS host after migration by checking DNS SRV records, GVLK configuration, firewall paths, and stale activation settings.
Fix devices still enrolling into the old Intune tenant after migration by checking MDM authority, enrollment profiles, Autopilot assignment, and stale device management records.
Fix network devices still sending TACACS+ authentication to the old server after migration by checking AAA groups, device templates, shared secrets, and stale management policy.
Fix certificate validation still checking the old PKI after migration by reviewing CRL distribution points, OCSP responder URLs, AIA metadata, and stale certificate profiles.
Fix devices still requesting certificates from the old CA after migration by checking certificate templates, auto-enrollment policy, AD publication, and stale enrollment endpoints.
Fix VPN clients still connecting to the old gateway after migration by checking client profiles, portal configuration, DNS aliases, and stale remote access settings.
Fix network authentication still using the old RADIUS server after migration by checking AAA settings, shared secrets, policy targets, and stale access infrastructure references.
Fix SCIM provisioning still pointing to the old identity endpoint after migration by checking base URLs, bearer tokens, provisioning apps, and stale user lifecycle integrations.
Fix LDAP authentication and sync failures after migration by checking bind hosts, service accounts, LDAPS settings, and applications still querying the old directory server.
Fix OIDC login failures after migration by checking issuer URLs, discovery documents, client settings, and applications still validating tokens against the old identity provider.
Fix a SAML ACS URL still pointing to the old domain after app migration by checking identity provider settings, service provider metadata, and stale single sign-on endpoints.