Configure the WSUS Synchronization Proxy
Configure WSUS synchronization credentials and endpoint in its own console rather than relying on an administrator browser or treating the setting as client policy.
On an existing WSUS server, configure the proxy for synchronization in WSUS itself. A browser session working under an administrator's account does not establish that the synchronization service has the same route or credentials.
In the WSUS Administration Console, open Options, then Update Source and Proxy Server. On the proxy tab, enable proxy use for synchronization and supply the listener's server name and port; for a Microsoft Update test that permits public proxies and has no proxy credentials configured, select an HTTP candidate from the HTTP proxy list.
If that proxy requires a specific account, enter its user, domain and password using WSUS's credential fields. The domain field should reflect the account arrangement supplied by the proxy administrator; it is not necessarily the public DNS suffix of the proxy hostname.
Microsoft documents this setting as applying to WSUS synchronizations, including synchronization against an upstream WSUS server or Microsoft Update. It does not configure every downstream computer's browser or Windows Update connection.
The console also offers Basic authentication explicitly. Treat that as an authentication choice, not a generic “make login work” checkbox: Microsoft warns that its password is sent without encryption by that mechanism.
When synchronization still fails, record the configured update source and the stage of the failure. An unreachable proxy listener, a proxy authentication rejection and a failure after reaching the upstream service need different fixes. Re-entering the browser's working password says little until WSUS is using the expected proxy account.