troubleshooting

Note-to-self: offline preparation for MIM Portal on Sharepoint 2019 without internet connection
  1. Introduction
    1. Prerequisites
  2. AppFabric troubleshooting
    1. Troubleshooting Error 1603
    2. Solution (in my case)
    3. Other reference:

What if you need to install MIM (Microsoft Identity Manager) Portal on a server that has no internet connection?

Introduction

When installing MIM you could face a situation where the MIM servers is part of intranet, and internal domain, but without internet connection.

If you’re lucky the internet connection is redirected via an internet proxy, but that’s not always the case… Highly sensitive servers, like domain controllers or identity management servers, are better kept disconnnected or at

It’s a common scenario to avoid that an internal server (and in this case the MIM server) is establishing a break-out connection to internet.

But when you install Sharepoint for the MIM portal server, the installation wizard has some prerequisites to install and by default it will fetch the prerequisites… from internet.

Prerequisites

Source: https://learn.microsoft.com/en-us/sharepoint/install/hardware-and-software-requirements-2019

  • Web Server (IIS) role (server feature)
  • Windows Process Activation Service feature (server feature)
  • Microsoft .NET Framework version 3.5 (server feature)
  • Microsoft .NET Framework version 4.7.2 (server feature)
  • Microsoft SQL Server 2012 Service Pack 4 Native Client
  • Microsoft WCF Data Services 5.6
  • Microsoft Identity Extensions (identity foundation > server feature)
  • Microsoft Information Protection and Control Client 2.1 (MSIPC)
  • Microsoft Sync Framework Runtime v1.0 SP1 (x64)
  • Windows Server AppFabric 1.1
  • Cumulative Update Package 7 for Microsoft AppFabric 1.1 for Windows Server (KB 3092423)
  • Visual C++ Redistributable Package for Visual Studio 2012
  • Visual C++ Redistributable Package for Visual Studio 2017

The server features you need to install from the Windows Server manager > Add Roles and Features.

The other options will be fetched from internet, but if you can’t connect to internet, you can manually download them.
Source information

Due to the lack of the internet connection you might also see an additional erro when installin the AppFabric module..

AppFabric troubleshooting

Troubleshooting Error 1603

Solution (in my case)

https://stackoverflow.com/questions/26026901/installing-appfabric-1-1-with-powershell-dsc-results-in-modal-dialog-error

Installation of AppFabric with verbose logging: 

            Start-Process -FilePath 'c:\temp\SharePoint\pre\appfabric\setup.exe' -ArgumentList '/i cacheclient","cachingService","CacheAdmin /gac /l c:\temp\appfabric.log' -Wait | Write-verbose

Other reference:

MIM 2016 SP2 Troubleshooting: MIM2016 setup System Error MSVCR120.dll was not found
  1. Issue
  2. Error info
  3. Solution
  4. Download

Issue

When installing MIM 2016 on Windows Server 2022, you encounter an error:

Error info

The code execution cannot proceed because MSVCR120.dll was not found. Reinstalling the program may fix this problem.

Solution

Install the Visual C++ Redistributable Packages for Visual Studio 2013 from the Microsoft Download center.

Download

Download Visual C++ Redistributable Packages for Visual Studio 2013 from Official Microsoft Download Center

Outlook troubleshooting: Outlook keeps prompting for password

Overview

Issue: when opening Outlook and afterwards on a regular intervals afterwards, Outlook keeps prompting for a password multiple times (x5 or more), even when the password is correct.

The error/connection message is sent to the desktop foreground on top of other applications.

Even when the password is ok, the message is thrown again multiple times, when the Outlook client is checking for mail, at certain intervals…

[Solution Spoiler = configure the registry to enable ExcludeExplicitO365Endpoint, but there might be other options for your case…]

Product version

In this specific situation, the products below were involved. The issue might also apply to other versions

  • Office version= Microsoft 365
  • Outlook version Microsoft® Outlook® for Microsoft 365 MSO (Version 2109 Build 16.0.14430.20224) 64-bit
  • Exchange server version 15.1.2308.4008. (on premises)

Additional information

Type of mailbox

In this case, the issue was related to connecting to a functional/shared mailbox.
Connection to the personal mailbox was working fine, at first sight.

Standalone vs Domain

In this particular case, the PC was not connected to the domain of the Exchange server.

But also important connection on Outlook from domain joined PC is ok, no reconnection message.
[More on this at the end of the article, as the domain client had specific GPO policies configured, …]

Multiple mail accounts

Outlook connected to multiple mail accounts (so removing Outlook completely, was not really an option…)

No issue on phone

Connecting the same account on a smartphone, works fine.

Symptoms

Error message

No explicit error message but you get a window with

“Windows security

Microsoft Outlook

Connecting to <… mailbox …>

Remember my credentials”

Error screen

Troubleshooting

Account credentials

WARNING:

you might end up with a locked user account if you enter the wrong credentials by accident while outlook keeps popping up the password request. Better double check your password and better NOT enter it again, or change it in the password request. But you’ll get this request multiple times in a few seconds, that it can be quite annoying to get past it.

Mail account

  • Tried to reinstall the mail account.
  • Removed the mail account and reinstalled mail account.

Configuration panel – Mail profile

Create a new Outlook profile (do NOT remove the existing Outlook profile) and add ONLY the problematic account. Set it to ONLINE mode (disable caching mode)

You can manage this option via Control Panel > mail

Alternatively, when reinstalling the mail account in outlook, disable the option “Use cached Exchange Mode to download email to an Outlook data file”.

Check Outlook connection status

When Outlook is active, you’ll find an Outlook icon in the task bar…

To check the Outlook connection status you need to hold the CTRL button and then right click on the Outlook icon.

Then click “Connection Status…”


Check if you see the personal mailbox and shared mailbox connection.

Test Email AutoConfiguration…

When Outlook is active, you’ll find an Outlook icon in the task bar…

To check the Outlook connection status you need to hold the CTRL button and then right click on the Outlook icon.

Then click “Test Email AutoConfiguration…”

In the menu enter the mail address of the target mailbox, in this case it’s a share mailbox with a specific mail address.

Very likely you’ll see a bunch of autodiscover failures like:

Alternative – Network analysis with Fiddler

You can collect a network log with Fiddler or other network sniffer

www.telerik.com

  1. Install Fiddler.
  2. Select decrypt https traffic
  1. Close fiddler
  2. Close all programs, messengers, browser etc.
  3. Start Fiddler
  4. Start Outlook and wait until problem comes up
  5. When problem appears STOP fiddler and close Outlook
  6. Check the log files and see if you can detect the issue.

Solution

Policy control via registry setting

Source: Outlook 2016 implementation of Autodiscover

This applies to 2016 2019 etc… as well.

The policy values that are defined the Autodiscover Process section can be either policy-based registry values or non–policy-based values.  When they are deployed through GPO, or manual configuration of the policies key, the settings take precedence over the non-policy key.
Non-Policy Key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover
Policy Key: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\AutoDiscover
Each value is of type DWORD.

So to exclude Office365 checking point we add following key:

ExcludeExplicitO365Endpoint and set the value to 1.


This setting is registry for client only.
Outlook will skip checking Office365 Endpoint for Autodiscover.

If you have already configured XML autodiscover it should not affect the existing setting as the information are stored in this XML file locally anyway so Outlook will know how to connect.

Outlook as priority always prefer local XML configuration. Then in case it cannot obtain certain data goes to another check point. So apart from first two steps  Outlook 2016 implementation of Autodiscover (microsoft.com) there are checking points we can configure how Outlook should obtain certain information. We can disable them or force them.

You can give it a try if this won’t work as desired you can always revert the changes.

Always make a copy of your registry before you change anything in the registry.

There is no really any other way from the client perspective.

In our case we can see many redirections and autodiscover failures. Not sure why, looks like Outlook refers to some old data or old domain URLS or cannot obtain properly Autodiscover configuration file and it is trying different combinations to guess which link for Autodiscover is working.
Once it calls for HTTPS Autodiscover of the correct link it gets timeouts… which might also indicate firewall issue or something.

Then it tries unencrypted HTTP and it succeeds. Now it redirects to Autodiscover configuration link. But it takes a few attempts to get there.
That’s why you get multiple popups of the error message / or the password prompt.

Why the issue did not hit the domain joined mail clients?

The mail administrator had following options configured already:

Setting the options for

  • DisableAutodiscoverV2Service = 1
  • ExcludeExplicitO365Endpoint = 1
  • excludehttpredirect = 1
  • excludehttpsautodiscoverdomain = 1
  • excludehttpsrootdomain = 1
  • excludelastknowngoodurl = 1
  • excludeScpLookup = 1
  • excludesrvrecord = 0
  • zeroconfigexchangeonce = 1

References

Note-to-self: public website/server certificate quick check.

Today my ESET Endpoint Security blocked my browser for what I know is (sorry, should be) a legitimate magazine website…

Using other browsers (Chrome, Firefox, Opera, Tor, …) on my machine, I had the same issue…

Microsoft Edge

ESET Endpoint Security is reporting

“Website certificate revoked

The certificate used by this server has been marked as untrustworthy and the connection is not safe

Try connecting again later or from a different internet connection.
Access to it has been blocked.“

Tor

Using another pc or smartphone (not using ESET) … I was able to connect.

So what’s going on?

ESET protecting you…

Eset forums

When you look up the Eset message (“Website Certificate Revoked” eset), you’ll probably land on the ESET forums or knowledge base, … seems to be a pretty popular topic.
Like for example: https://forum.eset.com/topic/21531-eset-giving-website-certificate-revoked-message/

ESET knowledge base

https://support.eset.com/en/kb6258-website-certificate-is-revoked-is-displayed-when-visiting-legitimate-web-pages

ESET explains

“This warning is displayed when your ESET product detects that the security certificate for a website is revoked.

ESET cannot resolve the issue because only the owner of a domain can renew their security certificate. You cannot choose to continue to the site using the insecure certificate.”

How do you double check this information?

The ESET forums point to a very interesting and eays to use tool: SSLTest at SSLLabs.com

Open: https://www.ssllabs.com/ssltest/index.html

Then you can enter the URL of the website you want to visit or check…

Depending the status of the website (good…or bad), it will take a few seconds… to minutes… to scan the website and show the quality of the certificate.

In this case, it’s fairly clear why the website was blocked:

Just for your reference if you would check a website like: https://docs.microsoft.com, you’ll get A+ (that’s the other end of the scale..)

If you want to know more about the website rating, check the SSLLabs rating guide:

https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide

The grading results in a score from A (top), (B) good, (C) average .. to (F) big fail lowest score …

So, it’s a very handy and free tool to check your website for issues.

Why are these websites not blocked by other tools or browsers?

First of all, check if you have an anti-virus or antimalware tool that checks the URL.

Because other browsers, apps or URL filters will not always check for the CRL (the certificate revocation list, containing certificates that are no longer valid…).

Or the CRL is not updated or and old CRL is cached. The ESET KB article mentioned, explains how to clear the CRL cache on your system.

Other interesting tools

The website (or mail) certificate is just one of the security indicators …
If you want to check the reputation of your URL, domain, website, mail system, DNS, … there are some more interesting tools you should have at hand, like https://mxtoolbox.com/NetworkTools.aspx.

Quite a while ago I posted an article on web and mail reputation, there is some more interesting free tools you can use to check the domain reputation.

See here: (TechNet Wiki) Hotmail/Outlook.com Solving Mass Mailing Delivery Issues

Conclusion

This situation show how easy it is to land on a website using revoked or unverified certificates…

Make sure to use a decent anti-malware and anti-virus tool. It’s worth to spend a small bit of money to protect your systems.

And if you combine it with some free tools to check the health of (your) websites and systems… you can achieve a decent level of security without spending a lot of money.

Published on TNWIKI: .Net Framework 3.5 Troubleshooting: installation errors (Permission issue)

Published at: .Net Framework 3.5 Troubleshooting: installation errors (Permission issue)

Applies to

  • Window Server 2016

Issue

.Net Framework 3.5 installation fails on Windows Server 2016

Troubleshooting

Tried many solutions like below

.NET 3.5 Uninstall detected

See:
MIM 2016 Troubleshooting: The installation just hanging without error, warning, log, Event-log

Windows Feature installation

See:
Windows Server 2012 R2 Troubleshooting: .NET Framework 3.5 installation failure (Offline/Online)

GPO Setting

See:
.Net Framework 3.5 Troubleshooting: installation errors (GPO)

Hotfix issue

See:
SharePoint 2013 Troubleshooting: NET 3.5 framework add feature error (the source files could not be found)

Solution

Grant read permission to the Everyone group on the installation files.

Check:
https://docs.microsoft.com/en-us/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features

 

Important

When you are installing feature files from a remote source, the source path or file share must
grant Read permissions either to the
Everyone group (not recommended for security reasons), or to the computer (local system) account of the destination server; granting user account
access is not sufficient.

Servers that are in workgroups cannot access external file shares, even if the computer account for the workgroup server has
Read permissions on the external share. Alternate source locations that work for workgroup servers include installation media, Windows Update, and VHD or WIM files that are stored on the local workgroup
server.

See also

References

 

Fresh on TNWiki: MIM 2016 Troubleshooting: The installation just hanging without error, warning, log, Event-log

Published on TNWIKI: MIM 2016 Troubleshooting: The installation just hanging without error, warning, log, Event-log

Credits

This issue was initially reported by
Guy Horn on LinkedIN, republished with permission.

(Guy Horn’s LinkedIn profile)

Issue

When you try to install MIM, it continuously fails.

You can’t  add .NET Framework 3.5.

Symptoms

The installation was just hanging without error, warning, log, Event-log

Root cause

The problem was that some features were removed from the Windows Server Image.

Solution

NetFx3 should be specified and not ‘Net-Framework-Core’.

After re-adding the feature just ‘Add-WindowsFeature Net-Framework-Core’.

Detecting the issue

Run this PowerShell command, to find the removed features

# This command shows removed items from the Windows Azure Server 2016 Datacenter image.

Get-WindowsFeature
| Where-Object
-FilterScript {($_.installstate
-like “Removed”)}

Solution

Restore the optional feature

# This command restores the optional feature, MyFeature, to the Online Windows image. If the files are not found in the source image, this command specifies not
to check Windows Update for the source files.

Enable-WindowsOptionalFeature
-Online -FeatureName
“NetFx3” -Source
f:\sources\sxs -LimitAccess
-All

Add .NET FW core

# Add the feature

Add-WindowsFeature
-name net-framework-core

Script

# This command shows removed items from the Windows Azure Server 2016 Datacenter image.

Get-WindowsFeature
| Where-Object
-FilterScript {($_.installstate
-like “Removed”)}

 

# This command restores the optional feature, MyFeature, to the Online Windows image. If the files are not found in the source image, this command specifies not
to check Windows Update for the source files.

Enable-WindowsOptionalFeature
-Online -FeatureName
“NetFx3” -Source
f:\sources\sxs -LimitAccess
-All

 

# Add the feature

Add-WindowsFeature
-name net-framework-core

 

 

Using SPF to block mail account spoofing

Introduction

Did you ever got a mail from yourself, but you’re sure you did not send it?

This week I got that mail from a mail alias I’m using, so it’s actually not a native mailbox, but a mail forwarder address, which makes the claim that “the mailbox is hacked” pretty silly…

But if you got this message from a native mailbox, it does sound scary, isn’t it?

I already had some similar symptoms on other mail addresses in the same domain.

Symptoms

You get a mail from your own mail address… which is called mail spoofing.
And it looks like:

mailspoof

Spoofed mail message content

Hi!

As you may have noticed, I sent you an email from your account.
This means that I have full access to your account.

I’ve been watching you for a few months now.
The fact is that you were infected with malware through an adult site that you visited.

If you are not familiar with this, I will explain.
Trojan Virus gives me full access and control over a computer or other device.
This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.

I also have access to all your contacts and all your correspondence.

Why your antivirus did not detect malware?
Answer: My malware uses the driver, I update its signatures every 4 hours so that your antivirus is silent.

I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can send this video to all your emails and contacts on social networks.
I can also post access to all your e-mail correspondence and messengers that you use.

If you want to prevent this,
transfer the amount of $778 to my bitcoin address (if you do not know how to do this, write to Google: “Buy Bitcoin”).

My bitcoin address (BTC Wallet) is: 1GoWy5yMzh3XXBiYxLU9tKCBMgibpznGio

After receiving the payment, I will delete the video and you will never hear me again.
I give you 48 hours to pay.
I have a notice reading this letter, and the timer will work when you see this letter.

Filing a complaint somewhere does not make sense because this email cannot be tracked like my bitcoin address.
I do not make any mistakes.

If I find that you have shared this message with someone else, the video will be immediately distributed.

Best regards!

Root cause

The DNS setting of your domain is missing SPF records, that counter mail spoofing (an unauthorized mail server, user or hacker sending mail as “you”)…

Troubleshooting

When looking at the mail properties it’s pretty difficult (if not impossible) to find out who actually has sent the mail….

Solution

Basic domain settings

Add an SPF record to your domain DNS settings.

To get started, look up your mail provider or hosting provider’s name + SFP.

FYI, I’m hosting my domains at one.com, they’ve got some straight forward advise to configure the DNS. For any other domain, at any other provider it’s similar.

Office 365

When you buy a domain, but host your mail on O365, there are some additional settings to configure. But Office 365 will explain.

The easy part, logon to your O365 tenant, and check your domain health (see video below)

For more info, check these documents:

References

SPF tooling

Other security options

See also

Hotmail/Outlook.com Solving Mass Mailing Delivery Issues

Short URL: Http://aka.ms/outlook.com/help

While SPF is the first step, you should also consider DMARC and DKIM.

Latest update: 2020-12-28

Please be aware of EUDT. BE unethical and dirty domain sales tricks (EN version)

fraudwarning

For the last 2 months I have been receiving some fraudulent, unethical and threatening mails from a company named “European Domains & Trademarks”, with the e-mail domain EUDT.BE, registered company name “Domeinnaam Register”.

The company is linked to: http://www.domeinnaamregister.com/ en http://www.nederlandsdomeinregister.nl/
In the Netherlands the company is registered as KVK: 64626679 and VAT: NL201158802B01. (as published on their website, the commerce register and DNS registrar).

The company is making false claims and is using unethical practices, and scaring people to extort money and scamming people into ridiculous expensive and fraudulent contracts.

The official registration owner of this URL and company is a Dutch company that is a very well known for very bad scamming practices.
And also the Belgian domain registration authority is warning for this company:
https://www.dnsbelgium.be/en/news/watch-out-domain-name-offers-domeinnaamregistercom

This is not their first warning, it already was reported in 2013 and 2016 (see below).

Also in the Netherlands, this organization is known and has been reported for the same malpractices before, like:

What it is about?

See full text at end of this post.

In short, he company contacts people, entrepreneurs, company owners pretending that they received a request to register a domain name (like company.nl) similar to the company domain you already registered (like company.com) and that they are legally forced to contact you to offer the first registration.

Next they say that they are obliged to register and protect the domain name for 10 year for €19.75 (ex VAT!) per year. And you need to pay this in one shot.

And a lot more bullshit in the mail…

What should you do?

  • DO NOT react to the mail, and ignore the mail,
  • before deleting the mail: report these practices to the authorities (eg Ministry of Economic Affairs)

If you really want that domain

  • DO NOT react to the mail, ignore the mail, delete the mail
  • contact your favorite, official and trusted registrar and by the domain via the regular / official channel

Why is this bullshit?

Please be aware that

  • domain registration is on a “first come, first serve” basis (unless it’s a malicious registration to harm a target company)
  • domains like .BE,  .NL, EU… cost about €6, €8, … 12 EUR per year.
  • Some registrars offer decent discounts, so it can be even cheaper.
  • You can renew domains YEARLY, no need to pay 10 years upfront.

See also

(BE-NL) Verkooptrucs met domeinnamen (*) (Credits: Dries Van Giel op 15 juni 2018)

More information

Credits: Dries Van Giel (*)

Belgium

Official warnings by DNS.BE

Official registrars

Warnings from official domain registrars and site hosters (no strings attached!)

Log a complaint at

If you’re already been caught by these #holes, you can register a complaint at: https://meldpunt.belgie.be/meldpunt/nl/welkommeldpunt.belgie.be

Netherlands

Full text (NL)

(Source: Happywebsites)

Geachte heer/mevrouw ,

Recent hebben wij telefonisch contact met u op proberen te nemen. Dit is tot op heden nog niet gelukt. We sturen u dus een email met daarin informatie over het volgende:
We hebben een aanvraag binnen gekregen om de website http://www.questforsecurity.eu te laten registreren. We zien in ons systeem dat u de eigenaar bent van http://www.questforsecurity.be. Helaas kan dit voor u in de toekomst verstrekkende gevolgen hebben. We zijn daarom dus wettelijk verplicht om contact met u op te nemen om u het eerste registratierecht te bieden. Dit houdt in dat wij de aanvraag van de derde partij afwijzen en de website:

http://www.questforsecurity.eu

Na een akkoord zullen doorlinken naar:

http://www.questforsecurity.be

Het komt er op neer dat u de eerste optie op de domeinnaam krijgt, dit om eventuele problemen in de toekomst te voorkomen. De aanvraag is gedaan vanuit de regio Antwerpen.
Doorgaans zijn wij verplicht om de domeinnaam voor 10 jaar vast te leggen en te beschermen. De jaarlijkse prijs voor de .EU extensie is € 19,75 per jaar. Dit betekent dus een eenmalig bedrag van €197,50. Wanneer de doorlink voltooid is, zal al het verkeer wat naar de .EU extensie gaat, automatisch op uw .BE extensie terecht komen. De verwerking hiervan duurt maximaal 24 uur. Deze domeinnaam is dan wereldwijd bereikbaar. De derde partij wordt afgewezen en deze kan niks met uw domeinnaam doen.
Overige informatie:

U ontvangt een eenmalige factuur van €197,50 exclusief BTW voor een looptijd van 10 jaar.

Na een jaar kan het ten alle tijden geannuleerd worden. U krijgt dan het resterende aantal jaren op uw rekening teruggestort.

Indien u hiermee akkoord gaat, stuur dan binnen 24 uur na ontvangen van deze email een akkoord per mail naar met daarin uw naam, en factuurgegevens naar; bart@eudt.be
Hierop volgend gaan wij de derde partij afwijzen en de doorlink in orde maken. U krijgt dezelfde dag nog alles per mail toegestuurd met alle informatie die u nodig heeft.

Met vriendelijke groeten,

Bart Mulder
European Domains & Trademarks
http://www.eudt.be
bart@eudt.be

And also

…
Reynaud Laurent
European Domains & Trademarks
http://www.eudt.be
reynaud.laurent@eudt.be

Better be smart.
Be safe.

And I hope these ### will be stopped sooner than later.

#MIM2016 Troubleshooting: SQL Connection issues

On TNWiki you’ll find my latest article on MIM 2016 troubleshooting.

MIM 2016 Troubleshooting: SQL Connection issues

This week I got (dragged into/) involved in a MIM 2016 performance troubleshooting, on a test / dev server, facing a large bunch of errors.

The first detection happened on the sync server, but apparently rather it’s twin brother was causing the issues.

It became pretty quickly obvious that MIM was not able to connect to (one of) it’s databases on the SQL server, so the sync engine was unable to pull information from the MIM service.

Also bizar, we could still work on the MIM sync GUI, but almost any MA action in the GUI failed…

Furthermore the Portal did not respond and finally the “MIM Service” service, didn’t behave as expected, not willing to start.

The event viewer contained the obvious amount of errors…

Finally,  the SQL DBA to the rescue.

I’ve added a lot of significant technical event info into the article, to make it easy to search for you, for later reference.

Read the tech details in: MIM 2016 Troubleshooting: SQL Connection issues

Updated: 2020-12-29

Note-To-Self: ICYMI, #MIM2016 Support for SQL Always On Availability groups

Based on a recent customer support experience with MIM (migrating from MIM 2016 RTM to SP1 latest hotfix), I ran into a few issues…

They have been documented here:

And also

While investigating the MIM Performance, we bumped into some SQL configuration issues, seriously impacting the MIM performance.
Finally ending up with staging the latest hotfix on MIM… (which is in general always a good idea and best practice).

But, talking the SQL performance, in that troubleshooting exercise another question popped up, again: Always on Availability groups.

And while this has been an issues for long time, the good news is : as of MIM 2016 SP1 (4.4.1459.0 or Later), Always On Availability groups are now supported.

You can find the announcement here: https://blogs.technet.microsoft.com/iamsupport/2017/03/22/microsoft-identity-manager-2016-sp14-4-1459-0-or-later-support-for-sql-2016-always-on-availability-groups/

Strangely enough it’s not mentioned in the KB article for the hotfix: SP1 March 2017 Hotfix (4.4.1459.0),

Still, the page on SQL Server availability solutions for Microsoft Identity Manager services databases, is not mentioning AoA, see here: https://support.microsoft.com/en-us/help/3200896/sql-server-availability-solutions-for-microsoft-identity-manager-servi

So, you need to keep that one in your MIM knowledge backpack.

Updated: 2020-12-29