Entra Connect Health agent requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit cb72c7b · +18 −15 lines · also on GitHub
11
---
22
title: Install the Microsoft Entra Connect Health agents in Microsoft Entra ID
33
description: Learn how to install the Microsoft Entra Connect Health agents for Active Directory Federation Services (AD FS) and for sync.
4
+author: omondiatieno
5
+ms.author: jomondi
46
ms.subservice: hybrid-connect
57
ms.tgt_pltfrm: na
68
ms.date: 05/15/2026
79
ms.topic: how-to
8
−ms.custom: sfi-ga-nochange
10
+ms.custom: sfi-ga-nochange, msecd-doc-authoring-1012
11
+#customer intent: As an identity administrator, I want to install the Microsoft Entra Connect Health agents on my on-premises servers so that I can monitor the health of my hybrid identity infrastructure (AD FS, sync, and AD DS) from the Microsoft Entra admin center.
912
---
1013
# Install the Microsoft Entra Connect Health agents
1114
⋯ 4 unchanged lines
1619
> [!NOTE]
1720
> Microsoft Entra Connect Health is not available in the China sovereign cloud.
1821
19
−## Requirements
22
+## Prerequisites
2023
2124
The following table lists requirements for using Microsoft Entra Connect Health:
2225
⋯ 2 unchanged lines
2528
| You have a Microsoft Entra ID P1 or P2 subscription. |Microsoft Entra Connect Health is a feature of Microsoft Entra ID P1 or P2. For more information, see [Sign up for Microsoft Entra ID P1 or P2](~/fundamentals/get-started-premium.md). <br /><br />To start a free 30-day trial, see [Start a trial](https://azure.microsoft.com/trial/get-started-active-directory/). |
2629
| You're either a [Global Administrator](../../role-based-access-control/permissions-reference.md#global-administrator) or a [Hybrid Identity Administrator](../../role-based-access-control/permissions-reference.md#hybrid-identity-administrator) in Microsoft Entra ID. | By using Azure role-based access control (Azure RBAC), you can allow other users in your organization to access Microsoft Entra Connect Health. For more information, see [Azure RBAC for Microsoft Entra Connect Health](how-to-connect-health-operations.md#manage-access-with-azure-rbac). <br /><br />**Important**: Use a work or school account to install the agents. You can't use a Microsoft account to install the agents. For more information, see [Sign up for Azure as an organization](~/fundamentals/sign-up-organization.md). |
2730
| The Microsoft Entra Connect Health agent is installed on each targeted server. | Health agents must be installed and configured on targeted servers so that they can receive data and provide monitoring and analytics capabilities. <br /><br />For example, to get data from your Active Directory Federation Services (AD FS) infrastructure, you must install the agent on the AD FS server and on the Web Application Proxy server. Similarly, to get data from your on-premises AD Domain Services infrastructure, you must install the agent on the domain controllers. |
28
−| The Azure service endpoints have outbound connectivity. | During installation and runtime, the agent requires connectivity to Microsoft Entra Connect Health service endpoints. If firewalls block outbound connectivity, add the [outbound connectivity endpoints](how-to-connect-health-agent-install.md#outbound-connectivity-to-azure-service-endpoints) to an allowlist. |
31
+| The Azure service endpoints have outbound connectivity. | During installation and runtime, the agent requires connectivity to Microsoft Entra Connect Health service endpoints. If firewalls block outbound connectivity, add the [outbound connectivity endpoints](#outbound-connectivity-to-azure-service-endpoints) to an allowlist. |
2932
|Outbound connectivity is based on IP addresses. | For information about firewall filtering based on IP addresses, see [Azure IP ranges](https://www.microsoft.com/download/details.aspx?id=56519).|
3033
| TLS inspection for outbound traffic is filtered or disabled. | The agent registration step or data upload operations might fail if there's TLS inspection or termination for outbound traffic at the network layer. For more information, see [Set up TLS inspection](/previous-versions/tn-archive/ee796230(v=technet.10)). |
3134
| Firewall ports on the server are running the agent. |The agent requires the following firewall ports to be open so that it can communicate with the Microsoft Entra Connect Health service endpoints: <br />- TCP port 443 <br />- TCP port 5671 <br /><br />The latest version of the agent doesn't require port 5671. Upgrade to the latest version so that only port 443 is required. For more information, see [Hybrid identity required ports and protocols](./reference-connect-ports.md). |
⋯ 7 unchanged lines
3942
> If you have a highly locked-down and restricted environment, you need to add more URLs than the URLs the table lists for Internet Explorer enhanced security. Also add URLs that are listed in the table in the next section.
4043
4144
>[!IMPORTANT]
42
−>Microsoft Entra Connect Health now supports installation using the Hybrid Identity Administrator role. If you installed Microsoft Entra Connect Sync using an account with the role, the Entra Connect Health agent will automatically be in active state and you will not need to do a re-install using a Global Administrator account.
45
+>Microsoft Entra Connect Health now supports installation using the Hybrid Identity Administrator role. If you installed Microsoft Entra Connect Sync with a Hybrid Identity Administrator account, the Microsoft Entra Connect Health agent is automatically active and you don't need to reinstall it with a Global Administrator account.
4346
4447
### New versions of the agent and auto-upgrade
4548
⋯ 7 unchanged lines
5356
5457
Don't disable security monitoring or inspection of these URLs. Instead, allow them as you would allow other internet traffic.
5558
56
−These URLs allow communication with Microsoft Entra Connect Health service endpoints. Later in this article, you'll learn how to [check outbound connectivity](#test-connectivity-to-the-azure-ad-connect-health-service) by using `Test-MicrosoftEntraConnectHealthConnectivity`.
59
+These URLs allow communication with Microsoft Entra Connect Health service endpoints. To verify connectivity after installation, see [Test connectivity to the Microsoft Entra Connect Health service](#test-connectivity-to-the-azure-ad-connect-health-service), which uses the `Test-MicrosoftEntraConnectHealthConnectivity` cmdlet.
5760
5861
| Domain environment | Required Azure service endpoints |
5962
| --- | --- |
⋯ 4 unchanged lines
6467
6568
To download and install the Microsoft Entra Connect Health agent:
6669
67
−- Make sure that you satisfy the [requirements](how-to-connect-health-agent-install.md#requirements) to install Microsoft Entra Connect Health.
70
+- Make sure that you satisfy the [prerequisites](#prerequisites) to install Microsoft Entra Connect Health.
6871
- Get started using Microsoft Entra Connect Health for AD FS:
6972
- [Download the Microsoft Entra Connect Health agent for AD FS](https://www.microsoft.com/en-us/download/details.aspx?id=108565).
7073
- See the [installation instructions](#install-the-agent-for-ad-fs).
7174
- Get started using Microsoft Entra Connect Health for sync:
72
− - [Download and install the latest version of Microsoft Entra Connect](https://entra.microsoft.com/#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/GetStarted). The health agent for sync is installed as part of the Microsoft Entra Connect installation (version 2.5.79.0 or later).
75
+ - [Download and install the latest version of Microsoft Entra Connect](https://entra.microsoft.com/#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/GetStarted). The health agent for sync is installed as part of the Microsoft Entra Connect installation [version 2.5.79.0 or higher](reference-connect-version-history.md).
7376
- Get started using Microsoft Entra Connect Health for AD Domain Services:
7477
- [Download the Microsoft Entra Connect Health agent for AD Domain Services](https://www.microsoft.com/en-us/download/details.aspx?id=108565).
7578
- See the [installation instructions](#install-the-agent-for-azure-ad-ds).
⋯ 13 unchanged lines
8992
:::image type="content" source="media/how-to-connect-health-agent-install/install5.png" alt-text="Screenshot that shows the running Microsoft Entra Connect Health for sync services on the server.":::
9093
9194
> [!NOTE]
92
−> Remember that you must have Microsoft Entra ID P1 or P2 to use Microsoft Entra Connect Health. If you don't have Microsoft Entra ID P1 or P2, you can't complete the configuration in the [Microsoft Entra admin center](https://entra.microsoft.com). For more information, see the [requirements](how-to-connect-health-agent-install.md#requirements).
95
+> Remember that you must have Microsoft Entra ID P1 or P2 to use Microsoft Entra Connect Health. If you don't have Microsoft Entra ID P1 or P2, you can't complete the configuration in the [Microsoft Entra admin center](https://entra.microsoft.com). For more information, see the [prerequisites](#prerequisites).
9396
9497
<a name='manually-register-azure-ad-connect-health-for-sync'></a>
9598
⋯ 6 unchanged lines
102105
103106
Manually register the Microsoft Entra Connect Health agent for sync by using the following PowerShell command. The Microsoft Entra Connect Health services will start after the agent has been successfully registered.
104107
105
−`Register-MicrosoftEntraConnectHealthAgent -AttributeFiltering $true -StagingMode (Get-ADSyncScheduler).StagingModeEnabled`
108
+```powershell
109
+Register-MicrosoftEntraConnectHealthAgent -AttributeFiltering $true -StagingMode (Get-ADSyncScheduler).StagingModeEnabled
110
+```
106111
107112
The command takes the following parameters:
108113
⋯ 27 unchanged lines
136141
- Microsoft Entra Connect Agent Updater
137142
- Microsoft Entra Connect Health Agent
138143
139
−:::image type="content" source="media/how-to-connect-health-agent-install/install5.png" alt-text="Screenshot that shows Microsoft Entra Connect Health AD DS services.":::
144
+:::image type="content" source="media/how-to-connect-health-agent-install/install5.png" alt-text="Screenshot that shows how to check the status of Microsoft Entra Connect Health AD DS services.":::
140145
141146
### Quickly install the agent on multiple servers
142147
⋯ 124 unchanged lines
267272
268273
## Test connectivity to the Microsoft Entra Connect Health service
269274
270
−Occasionally, the Microsoft Entra Connect Health agent loses connectivity with the Microsoft Entra Connect Health service. Causes of this connectivity loss might include network problems, permissions problems, and various other problems.
275
+Occasionally, the Microsoft Entra Connect Health agent loses connectivity with the Microsoft Entra Connect Health service. Network or permission issues are typical causes.
271276
272277
If the agent can't send data to the Microsoft Entra Connect Health service for longer than two hours, the following alert appears in the portal: **Health Service data is not up to date**.
273278
⋯ 10 unchanged lines
284289
- `ADDS`
285290
286291
> [!NOTE]
287
−> To use the connectivity tool, you must first register the agent. If you can't complete the agent registration, make sure that you meet all the [requirements](how-to-connect-health-agent-install.md#requirements) for Microsoft Entra Connect Health. Connectivity is tested by default during agent registration.
288
−
289
−## Next steps
292
+> To use the connectivity tool, you must first register the agent. If you can't complete the agent registration, make sure that you meet all the [prerequisites](#prerequisites) for Microsoft Entra Connect Health. Connectivity is tested by default during agent registration.
290293
291
−Check out the following related articles:
294
+## Related content
292295
293296
- [Microsoft Entra Connect Health](./whatis-azure-ad-connect.md)
294297
- [Microsoft Entra Connect Health operations](how-to-connect-health-operations.md)
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:20 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.