Azure AD Connect: Error 8344 Permission Issue Insufficient Access Rights to Perform the Operation

If your sync service completed with error and the error code is shown below;

Error 8344: Permission Issue Insufficient Access Rights to Perform the Operation

It means that the service account that you used to add the domain during the wizard setup does not have the correct/necessary permissions.

In the wizard, is this part

Note:

Please do take note that this is only for Password Synchronization and Password Writeback, for further extend permission please review the references below.

Step by step;

1. Provide the necessary permission to the service account
   • Add the service account into the Administrators Group (Built-in OU)
   • At the forest level > Properties > Security > Add > service account
     • Next, select the service account, scroll to the permission and check “Replicate Directory Changes All” and “Replicate Directory Change“
     • Due to password writeback will be turn on too, another permission you have to give to this service account is the “Change Password” and “Reset Password” under the Advanced
       • Select the service account > Advanced > Select Add > Select Principal > Service account > Descendent User Objects > Check the box for “Change Password” and “Reset Password”
   • Save your changes
   • Refresh
2. Head to your AADC server and rerun the synchronization
3. Check the Sync status whether it is completed without error
4. The End

 

References:

1. https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions
2. https://mstechtalk.com/step-by-step-azure-ad-sync-installation-guide-part-1/

 

Appendix:

1. ADUC – Active Directory Users and Computers
2. ADS – Active Directory Sync
3. OU – Organization Unit
4. AADC – Azure Active Directory Connect

Do check out the latest blog post for this issue here https://sabrinaksy.com/2021/01/24/azure-ad-connect-event-code-8344-permission-issue/