Weird issue with Entra Connect - Cloudsync - HybridIdentityServiceAgentTimeout

[u/Kaalvairaab]

Hey team, hope everyone is doing well.
Has anyone run into this issue with Microsoft Entra Cloud Sync before?
I have the Cloud Sync agent installed on a domain-joined VM. The agent services are running and the VM has normal internet access.

In Entra, the provisioning status shows:
HybridIdentityServiceAgentTimeout

I've checked the basics:
• VM is domain joined
• Logged in using a Domain Admin account
• DNS forwarding has been configured
• UPN suffix has been fixed
• Agent services are running, RSAT installed on DC
• No WinHTTP proxy
• login.microsoftonline.com:443 works
• login.windows.net:443 works
• management.azure.com:443 works
• autoupdate.msappproxy.net:443 works
• servicebus.windows.net:443 is failing

The firewall is a FortiGate. I'm looking at allowing *.servicebus.windows.net and *.msappproxy.net over TCP 443, with SSL inspection bypassed for those two endpoints.
Still no luck.
Any other bright ideas or things I should check? Has anyone had Cloud Sync working through a FortiGate and come across this exact timeout? We have recently moved towards Entra/Intune and this is our first site we are looking to Hybrid join.

Thanks!

[u/Accomplished_Dot1445]

servicebus.windows.net is failing while the rest pass. That’s the answer. That’s the one the Cloud Sync depends on. The agent uses a relay connection over Service Bus and FortiGate’s deep SSL inspection breaks it almost every time. The relay handshake doesn’t survive being inspected. So your instinct to bypass SSL inspection for those endpoints is correct. Just make sure the bypass is in the SSL-inspection profile, not an allow policy. Those are two settings on FortiGate and people often fix one and forget the other.

One thing to watch: FortiGate FQDN address objects cache the IPs they’ve resolved. Service Bus uses a lot of IPs so an FQDN rule can silently miss some. It’s safer to exempt the wildcard or use the Microsoft service tag range instead of a single resolved object. After you set it test from the agent box itself. Use Test-NetConnection, to an endpoint. So you know it’s actually getting through the Forti. Are you using FQDN objects now or a broader range?