![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(259.20000000000005, 78%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERK%3C/text%3E%3C/svg%3E)
Microsoft Security | Microsoft Authenticator
A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
The error when connecting Azure AD Connect with an account that requires MFA matches the documented behavior: accounts enabled for Microsoft Entra multifactor authentication cannot be used with the legacy Azure AD (MSOnline) connection methods.
To resolve the issue and avoid error 121000 when users try to change passwords online, use one of these options:
- Use the correct UPN format
- Ensure the username is entered as
user@domain(for example,******@contoso.com) and not justadminorcontoso\\admin.
- Ensure the username is entered as
- Use an account without MFA for Azure AD Connect
- Create or choose a global administrator (or hybrid identity admin) account that does not have Microsoft Entra MFA enforced.
- Sign in to Azure AD Connect with this non‑MFA admin account.
- Temporarily disable MFA on the admin account
- If policy allows, temporarily disable Microsoft Entra MFA for the admin account that Azure AD Connect uses.
- Complete the Azure AD Connect configuration.
- Re‑enable MFA afterward for security.
The underlying limitation is that when an account is enabled for Microsoft Entra MFA, the Azure AD / MSOnline connection used by tools like Azure AD Connect cannot authenticate successfully, which produces the “Unable to authenticate your credentials”/MicrosoftOnlineException behavior.
References: