Microsoft Entra ID TLS 1.0 and 1.1 Error: "Silent Microsoft authentication failed"

Overview

This guide addresses Microsoft Entra ID (formerly Azure AD) authentication failures, including errors like "Silent Microsoft authentication failed" or "An existing connection was forcibly closed by the remote host". Common scenarios include:

• Microsoft Exchange Online mail sources not working
• Failure to create a new Exchange Online mail source
• Failure to configure notification settings with Exchange Online
• User group sync issues with Entra ID

The error is thrown because TLS 1.0 and 1.1 are no longer supported by Microsoft in Entra ID. TLS 1.2 must be used for all Entra ID actions at this time.

Error situations can be seen in Windows Event log like this (example):

-----------------------------------------------------------------------------------------------------------------------------------------

MPropertyPage2.cpp, 102, Authentication failed. (0x80040162)

MPropertySheet2.cpp, 143, Authentication failed. (0x80040162)

PropertySheetExternalLocation.cpp, 412, Authentication failed. (0x80040162)

PropertySheetExternalLocation.cpp, 605, Authentication failed. (0x80040162)

ExternalMailSourceClient.cpp, 183, Authentication failed. (0x80040162)

ExternalMailSourceClient.cpp, 183, Silent Microsoft authentication failed. One or more errors occurred. AADSTS1002016: You are using TLS version 1.0, 1.1 and/or 3DES cipher which are deprecated to improve the security posture of Azure AD. Your TenantID is: XXXXXXXXX. Please refer to https://go.microsoft.com/fwlink/?linkid=2161187 and conduct needed actions to remediate the issue. For further questions, please contact your administrator.

Trace ID: XXXXXXXX

Correlation ID: XXXXXXXX

Timestamp: 2022-08-03 14:35:51Z  (0x80040162)

(M-Files <version> 2022-08-03T14:35:51.371Z)

-----------------------------------------------------------------------------------------------------------------------------------------

 

Example error shown when creating a new Microsoft Exchange Online mail source in M-Files Admin:

Another example of an error message when creating a new Microsoft Exchange Online mail source or configuring Exchange Online in notification settings in M-Files Admin:

Solution

Entra ID requires connections to use TLS 1.2. Microsoft has discontinued support for TLS 1.0 and 1.1, so these versions must be explicitly disabled. It is not sufficient to simply enable TLS 1.2 or later.

Please consult the full pages linked below for detailed instructions. Note that this is a general operating system networking problem rather than an M-Files-specific issue. For additional help, contact Microsoft support or your IT provider, as this falls outside the scope of M-Files support.

Steps to enable TLS 1.2:

1. The following PowerShell script will check to see if TLS 1.2 is currently in use and what settings are currently used: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-tls-enforcement#powershell-script-to-check-tls-12
2. The following PowerShell script will enable TLS 1.2: TLS 1.2 enforcement for Microsoft Entra Connect Alternatively, you can follow this guide: https://go.microsoft.com/fwlink/?linkid=2161187
3. A server reboot may be necessary.

If M-Files Admin is running on a different machine than M-Files Server, these changes must be applied to both computers. M-Files Admin may attempt a connection test to Entra ID and this will fail if the TLS support is not correctly configured on both the M-Files Server and the M-Files Admin computers.

If you continue to encounter errors after enabling TLS 1.2, it may indicate that older versions of TLS remain active. Follow these steps to resolve the issue:

1. Confirm that .NET Framework 4.7.2 or 4.8 is installed on both the M-Files Server and the M-Files Admin computer (if they are on separate machines)..
2. Enable strong cryptography for .NET: https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client#configure-for-strong-cryptography
3. Restart the computers after making these changes.
4. If the error persists, disable TLS 1.1, TLS 1.0, and SSL3 on both computers, then restart them again: https://learn.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings?tabs=diffie-hellman#tls-dtls-and-ssl-protocol-version-settings

Refer to Check and modify TLS versions from registry for additional guidance.

Notes

Note 1

Disabling old TLS versions can break OLE DB providers: Microsoft OLE DB Provider for SQL Server does not Support TLS 1.2 for External Database Connections (Workaround)

Note 2

In general, any error codes beginning with AAD (referring to Azure AD, now known as Entra ID), such as AADSTS1002016, should be researched using articles available at https://learn.microsoft.com/en-us/ for further information. These errors may arise at various stages of the authentication process during communication between M-Files and Entra ID.

If you encounter difficulties with the aforementioned solution or experience challenges disabling TLS 1.0/1.1 or enabling TLS 1.2, it is recommended to contact Microsoft support directly, as they are best equipped to assist with these issues.