By default .NET 4.0 uses TLSv1.0; some service providers are now enforcing use of TLSv1.1 or 1.2 affecting user provisioning from Cloud Access Manager. (4285568)

User provisioning fails to internet service providers like Salesforce, ServiceNow, Google Apps or Microsoft Office 365 when connections using TLSv1.0 are rejected.

Cloud Access Manager makes direct connections from the STS server to service providers to provide just-in-time user provisioning functionality. The Cloud Access Manager Web app and associated QuickConnect connectors run on .NET 4.0 which by default uses TLSv1.0 for encryption of internet traffic. TLSv1.0 is now in the process of being deprecated and service providers are starting to require a higher version for encryption and rejecting connections that still use v1.0. 

Salesforce recently released a critical update for this reason and although this update is not yet enabled by default users can turn it on whenever they choose. At some point it will become the default:

http://help.salesforce.com/HTViewSolution?id=000232847&language=en_US

Switch the supported TLS version in .NET 4.0+ on all deployed Cloud Access Manager STS servers to v1.2 in the registry (only the 64 bit entry needs to be modified).

Set or create the key SchUseStrongCrypto DWORD with value 1 at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319

You can also use power shell (as Administrator):

Set-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 -Name SchUseStrongCrypto -Value 1

Use -Value 1 to set all installed versions of .NET 4.0+ to use TLSv1.2 and use -Value 0 to reverse the change.

This change may require a restart of the server to take effect.