Earlier this week I was attempting to create an Entra ID Kerberos server object, and I kept running into these errors:

Set-AzureADKerberosServer : Failed to read secrets from the domain Set-AzureADKerberosServer : Failed to connect to domain

Normally these errors occur for these reasons:

1. The Microsoft.Online.PasswordSynchronization.Rpc.dll is missing from the server, or the server is missing a .dll from the AzureADHybridAuthenticationManagement module

2. The cloud credentials and the domain credentials are entered incorrectly.

In the Global Secure Access client Health Check, the “Breakglass mode is enabled” error typically indicates an issue with the Traffic forwarding configuration in the Microsoft Entra admin center.

If the Advanced Diagnostics of the Global Secure Access client displays this error, you can resolve it by following these steps:

1. Navigate to the entra.microsoft.com admin portal.

2. Go to “Traffic forwarding.”

3. Verify that the traffic forwarding profiles are enabled.