AAD Connect Health and outbound proxy server

Question

Fired up the Azure AD Connect Health preview on some AD FS 2012 R2 servers today. Installation went fine and the servers show up in the portal, but no data is flowing. Event log shows repeated exceptions trying to connect to:
https://policykeyservice.dc.ad.msft.net/clientregistrationmanager.svc/AgentUpdateCheck?tenant=<mytenantguidhere>&env=adfs&productname=Microsoft.Identity.Health.Agent¤tversion=1.0.15022.0
The machines are on private IP addresses but have a proxy server configured (netsh winhttp set proxy). I'm not seeing any requests hit the proxy log, so I'm guessing the initial install used my IE proxy settings, but the service is not using the system proxy
config as it should.
Seems like a bug. Am I doing something wrong?
Cheers.

Answer 1

Event 171 from source Monitoring Agent. Not a simple HTTP 403 or 404 error -- the proxy is not being used so the system cannot be reached at all.
UpdateChecker.ThrottleUpdateInterval;Scheduling next attempt in 5 minutes. Exception: There was no endpoint listening at
https://policykeyservice.dc.ad.msft.net/clientregistrationmanager.svc/AgentUpdateCheck?tenant=my-tenant-guid&env=adfs&productname=Microsoft.Identity.Health.Agent&currentversion=1.0.15022.0 that could accept the message. This is often caused
by an incorrect address or SOAP action. See InnerException, if present, for more details. Unable to connect to the remote server
System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at
https://policykeyservice.dc.ad.msft.net/clientregistrationmanager.svc/AgentUpdateCheck?tenant=my-tenant-guid&env=adfs&productname=Microsoft.Identity.Health.Agent&currentversion=1.0.15022.0 that could accept the message. This is often caused
by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected
party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 168.61.179.146:443
   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)
   --- End of inner exception stack trace ---
   at System.Net.HttpWebRequest.GetResponse()
   at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)
   --- End of inner exception stack trace ---
Server stack trace:
   at System.ServiceModel.Channels.HttpChannelUtilities.ProcessGetResponseWebException(WebException webException, HttpWebRequest request, HttpAbortReason abortReason)
   at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)
   at System.ServiceModel.Channels.RequestChannel.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
Exception rethrown at [0]:
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
   at Microsoft.Online.KeyAndPolicyService.Contracts.IClientRegistrationManager.CheckForAgentUpdate(String tenantName, String environment, String productName, String currentVersion)
   at Microsoft.Online.Reporting.MonitoringAgent.ClientRegistration.CheckForUpdates()
   at Microsoft.Online.Reporting.MonitoringAgent.UpdateChecker.CheckForUpdates()
   at Microsoft.Online.Reporting.MonitoringAgent.UpdateChecker.CheckForAndApplyUpdates(TimeSpan curUpdateCheckInterval)
   at Microsoft.Online.Reporting.MonitoringAgent.UpdateChecker.RunUpdateChecker(TimeSpan curUpdateCheckInterval)
There's also event 137 from Monitoring Agent with the same basic issue:
Agent.DownloadPolicyAndUpdateProcessors;DownloadPolicyFailed:There was no endpoint listening at
https://policykeyservice.dc.ad.msft.net/policymanager.svc/MonitoringPolicy/my-tenant-guid/adfs that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. Unable to connect
to the remote server
System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at
https://policykeyservice.dc.ad.msft.net/policymanager.svc/MonitoringPolicy/my-tenant-guid/adfs that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.Net.WebException:
Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to
respond 168.61.179.146:443
   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)
   --- End of inner exception stack trace ---
   at System.Net.HttpWebRequest.GetResponse()
   at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)
   --- End of inner exception stack trace ---