Thank you for your answer, but the repair didn't solve the issue: same effect as restart the service (active for 30min then go back inactive).
I go deeper and see that the day I add a new DC 2016 on the domain, the AZUREADSSOACC (used for direct authentication) add been modified. Maybe, it is related to this.
So I tried the steps to roll over the Kerberos decryption key of the AZUREADSSO computer account (link = https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-faq#how-can-i-roll-over-the-kerberos-decryption-key-of-the-azureadssoacc-computer-account).
But error on steps one :
Get-AzureADSSOStatus : https://[...].registration.msappproxy.net/register/GetDesktopSsoStatus can't accept this message. Maybe du to incorrect address or incorect SOAP action. (translation here)
On event viewer:
Event ID 12020: The Connector was unable to connect to the service due to networking issues. The Connector tried to access the following URL: 'https://[...].bootstrap.msappproxy.net:8080/', Request ID: '{...}'. See Connector troubleshooting for more information: http://go.microsoft.com/fwlink/?LinkID=512316&clcid=0x409
On logs (%ProgramData%\Microsoft\Azure AD Connect Authentication Agent\Trace), I can see the IP from where the authentication agent want to communicate (100% Microsoft).
Hard to figure it out when never work with azure ! Maybe, I will try to open a case on MS.
Than you