AD Connect Port Requirements.

Table 1 – Microsoft Entra Connect and On-premises AD

This table describes the ports and protocols that are required for communication between the Microsoft Entra Connect server and on-premises AD.

Protocol	Ports	Description
DNS	53 (TCP/UDP)	DNS lookups on the destination forest.
Kerberos	88 (TCP/UDP)	Kerberos authentication to the AD forest.
MS-RPC	135 (TCP)	Used during the initial configuration of the Microsoft Entra Connect wizard when it binds to the AD forest, and also during Password synchronization.
LDAP	389 (TCP/UDP)	Used for data import from AD. Data is encrypted with Kerberos Sign & Seal.
SMB	445 (TCP)	Used by Seamless SSO to create a computer account in the AD forest and during password writeback. For more information, see Change a user account’s password.
LDAP/SSL	636 (TCP/UDP)	Used for data import from AD. The data transfer is signed and encrypted. Only used if you are using TLS.
RPC	49152- 65535 (Random high RPC Port) (TCP)	Used during the initial configuration of Microsoft Entra Connect when it binds to the AD forests, and during Password synchronization. If the dynamic port has been changed, you need to open that port. See KB929851, KB832017, and KB224196 for more information.
WinRM	5985 (TCP)	Only used if you are installing AD FS with gMSA by Microsoft Entra Connect Wizard
AD DS Web Services	9389 (TCP)	Only used if you are installing AD FS with gMSA by Microsoft Entra Connect Wizard
Global Catalog	3268 (TCP)	Used by Seamless SSO to query the global catalog in the forest before creating a computer account in the domain.

This table describes the ports and protocols that are required for communication between the Microsoft Entra Connect server and Microsoft Entra ID.

Protocol	Ports	Description
HTTP	80 (TCP)	Used to download CRLs (Certificate Revocation Lists) to verify TLS/SSL certificates.
HTTPS	443 (TCP)	Used to synchronize with Microsoft Entra ID.