The Microsoft Entra provisioning service runs three kinds of jobs: outbound provisioning to SaaS apps (usually over SCIM), inbound HR-driven provisioning from Workday or SAP SuccessFactors, and cross-tenant synchronization between tenants you own. All three report problems the same way: an error code on each failed event in the provisioning logs, and a quarantine state when a whole job keeps failing. This quick reference lists the codes Microsoft documents, with the meaning, the usual cause and the first check.
Codes in this quick reference
EncounteredQuarantineException: job quarantined, invalid credentials or no connection to the targetProvisioning page / Graph synchronizationJobEncounteredEscrowProportionThreshold: job quarantined, more than 40% of provisioning events failedProvisioning page / Graph synchronizationJobQuarantineOnDemand: Microsoft detected an issue and quarantined the jobProvisioning page / Graph synchronizationJobHTTP/404 Not Found instead of HTTP/200 OK: SCIM compliance issue (quarantine)Provisioning page (quarantine reason)Duplicate roles: imported roles must be unique (quarantine)Provisioning page (quarantine reason)Conflict, EntryConflict: conflicting attribute values in Entra ID and the appProvisioning logsTooManyRequests: the target app is receiving too many requestsProvisioning logsInternalServerError: the target app returned an unexpected errorProvisioning logs
+ 35 more codes in the tables below.
How to read these codes#
- Where: Entra ID › Monitoring & health › Provisioning logs (Reports Reader is enough), or the provisioning logs of one enterprise app. Data is kept 30 days with Microsoft Entra ID P1 or P2 and 7 days on the free edition; stream it to Azure Monitor to keep it longer.
- Each event has a status (Success, Failure, Skipped, Warning) and an action (Create, Update, Delete, Disable, StagedDelete, Other). Open it: Steps shows where it stopped (import, match, scope, evaluate, provision) and Troubleshooting & Recommendations shows the code and reason. Keep the change ID for support.
- Codes containing
AzureActiveDirectoryrefer to Microsoft Entra ID; Microsoft couldn't rename them. - Job health: the app's Provisioning page shows a quarantine message in the progress bar, the audit logs (filter Activity: Quarantine) keep the history, and a one-time email goes to the notification address.
Text
GET https://graph.microsoft.com/v1.0/auditLogs/provisioning?$filter=provisioningStatusInfo/status eq 'failure'&$orderby=activityDateTime desc&$top=5
GET https://graph.microsoft.com/beta/servicePrincipals/{id}/synchronization/jobs/{jobId}/
POST /servicePrincipals/{id}/synchronization/jobs/{jobId}/restartThe first request lists recent failures, the second returns the job status (including the quarantine reason) and the third restarts the job, optionally clearing escrows, quarantine or watermarks. Cloud Sync uses the same engine; its agent and quarantine errors are in the Entra Connect sync reference.
Quarantine and job-level errors#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
EncounteredQuarantineException | Invalid credentials; no connection between source and target | Expired or wrong secret token or admin credentials | Re-authorize under Admin Credentials, test the connection, recheck the app's tutorial |
EncounteredEscrowProportionThreshold | More than 40% of provisioning events failed | One systematic mapping or data problem | Fix the most frequent error in the logs, then restart |
QuarantineOnDemand | Microsoft detected an issue and quarantined the job manually | Service-side detection | Read the quarantine email and logs; open a support request if unclear |
HTTP/404 Not Found instead of HTTP/200 OK | SCIM compliance issue | Wrong tenant URL, or an endpoint that isn't SCIM-compliant | Check the tenant URL; ask the app developer about compliance |
| Duplicate roles | Imported roles must be unique | Duplicate role from apps such as Salesforce or Zendesk | Remove it in the application manifest |
Microsoft says the thresholds can change, but roughly: escrow quarantine is evaluated from about 5,000 failures; more than 40% failed events or more than 40,000 failures triggers it (manager and group-member reference failures don't count), and 60,000 failures of any kind is an absolute limit. In quarantine, incremental cycles slow to once a day, and retries follow at 6, 12 and 24 hours, then daily. After 28 days the escrow entry is removed and the job is disabled. Restart provisioning runs a full initial cycle that clears escrows, quarantine and watermarks.
App provisioning and SCIM errors#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
Conflict, EntryConflict | Attribute values conflict between Entra ID and the app | An app account already holds the value | Fix one side, or adjust matching so that account is matched and taken over |
TooManyRequests | The app throttled the update | App overloaded | Nothing: retried automatically |
InternalServerError | Unexpected error from the app | App-side service issue | Retried in 40 minutes |
InsufficientRights, MethodNotAllowed, NotPermitted, Unauthorized | Authenticated but not authorized | Provisioning account or token lacks rights in the app | Follow the app's provisioning tutorial |
UnprocessableEntity | Unexpected response | App configuration or service issue | Check the app's configuration |
WebExceptionProtocolError | HTTP protocol error | Transient | Retried in 40 minutes |
InvalidAnchor | A user created or matched earlier no longer exists | Deleted in the app | Confirm the user exists; a Graph restart forces re-matching (full cycle, cache cleared) |
NotImplemented | Unexpected response | App configuration or service issue | Check the app's tutorial |
MandatoryFieldsMissing, MissingValues | Required values missing; user not created | Empty source attribute | Fill the source value or fix the mappings |
SchemaAttributeNotFound | Attribute doesn't exist in the app | Mapping to an unsupported attribute | Correct or remove the mapping |
InternalError | Provisioning service error | Service side | Retried in 40 minutes |
InvalidDomain | A value contains an invalid domain name | Domain not permitted in the app | Change the domain or allow it in the app |
Timeout | The app took too long to respond | App performance | Retried in 40 minutes |
LicenseLimitExceeded | No license left in the app | Seat limit | Add seats or tighten assignments |
DuplicateTargetEntries | Several app users match | Duplicate accounts in the app | Remove the duplicate or change matching |
DuplicateSourceEntries | Several source users match | Duplicate source values | Remove the duplicate or change matching |
ImportSkipped | Source user lacks the matching attribute | Empty matching value | Populate it; scope wasn't evaluated yet |
EntrySynchronizationSkipped | No action taken | Out of scope, or nothing to change | Usually fine; check scope if unexpected |
SystemForCrossDomainIdentityManagementMultipleEntriesInResponse | A GET returned several users or groups | SCIM endpoint ignores the filter, such as returning members | Fix the SCIM endpoint |
SystemForCrossDomainIdentityManagementServiceIncompatible | Response can't be parsed | SCIM server not compatible with the Entra SCIM client | Work with the developer |
SchemaPropertyCanOnlyAcceptValue | Single-valued target, multi-valued source | Mapping mismatch | Map a single-valued attribute or remove it |
Assigned users that show as skipped are usually excluded by a scoping filter or missing a required attribute. If the user is "not effectively entitled", the assignment record is broken: unassign and reassign the user or group.
HR-driven provisioning (Workday, SuccessFactors)#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
HybridSynchronizationActiveDirectoryInsufficientAccessRights (InsufficientAccessRights-SecErr: The user has insufficient access rights.. Access is denied. … Problem 4003 - INSUFF_ACCESS_RIGHTS) | The agent's account provAgentgMSA$ can't write this user | OU that doesn't inherit domain permissions, or a protected group (AdminSDHolder, adminCount = 1) | Re-enable inheritance and clear adminCount on orphaned accounts; otherwise, with approval, adjust AdminSDHolder |
InvalidAttributeSyntax-LdapErr: The syntax is invalid. The parameter is incorrect. Error in attribute conversion operation, data 0, v3839. | AD rejected an empty string | Null or empty HR value; value clearing is off by default | Enable null flow on the source attribute and the mapping, or use Switch or IgnoreFlowIfNullOrEmpty |
HybridSynchronizationActiveDirectoryCannotFindAttribute | Attribute not found in the AD schema | Attribute missing from the schema, or added after the agent started | Restart the provisioning agent: it caches the schema at startup |
Invalid value (provision on demand) | Manager not updated | Manager out of scope, not processed first, or default mapping changed | Restore the default mapping; provision the manager first |
Documented behaviors that look like errors:
- Matching on
extensionAttribute1–15fails for Entra ID targets; useemployeeID. - Mail updates to Entra ID don't apply because Exchange Online owns
mail; change it there. - Some Workday changes (such as LocalReference) aren't in the transaction log that incremental sync reads; schedule a periodic full sync.
- Workday terminations in Asia Pacific and Australia/New Zealand can lag 12–18 hours; use the termination lookahead query. For late SuccessFactors disables, Microsoft points to Lifecycle Workflows driven by the leave date.
- Repeated updates for multi-valued, custom security and account status attributes are a known limitation.
Cross-tenant synchronization errors#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AzureActiveDirectoryForbidden | dirSyncEnabled is true, so immutableId and extensionProperty1-15 can't be updated | Those attributes in the mappings | Remove them from the attribute mappings |
AzureActiveDirectoryForbidden | External collaboration settings blocked invitations | Restrictive guest invitation settings | Allow invitations in the target's external collaboration settings |
AzureActiveDirectoryCannotUpdateObjectsOriginatedInExternalService | Exchange Online is the source of authority for Exchange attributes (extensionAttribute1–15) | Users that existed when dirSyncEnabled changed from True to False | Update in the target's Exchange Online, for example Set-MailUser -CustomAttribute2 |
AzureActiveDirectoryCannotUpdateObjectsOriginatedInExternalService | Source of authority enforcement blocked Mail or showInAddressList | Graph SOA enforcement | The engine may retry without the property; otherwise update it in the target |
AzureDirectoryB2BManagementPolicyCheckFailure | Automatic redemption check failed | Automatic redemption missing on the target's inbound or the source's outbound settings | Enable it on both sides. Guide |
AzureActiveDirectoryQuotaLimitExceeded | Tenant object limit reached | Directory quota | Check whether the quota can be raised |
InvitationCreationFailure | Inviting the user in the target failed | Varies | Usually needs support |
InvitationCreationFailureUserAccountDisabled | User exists but is disabled; invitation pending | Disabled target account | Enable it and provision again |
InvitationCreationFailureInvalidPropertyValue | Invalid primary SMTP address, userType not Guest or Member, or the mail matches a group | Source data or mappings | Fix the source mail, map userType correctly or change the group address |
InvitationCreationFailureAmbiguousUser | Proxy address matches an internal user in the target | Duplicate proxy address | Delete the internal user or remove this user from scope |
AzureActiveDirectoryCannotUpdateObjectsMasteredOnPremises | Target user synced from AD and converted to external | Source of authority still on-premises | Cross-tenant sync can't update it |
EntityTypeNotSupported | Groups scope users but aren't synchronized (skipped) | Group selected for provision on demand | Nothing; pick a user instead |
AzureActiveDirectoryConflictEncountered | Conflicting object in the target | A contact with the same mail | Move the contact's group memberships, then delete it |
Once a synchronized user exists, sign-in problems in the target tenant are B2B errors; see guest sign-in errors.
How to verify a fix#
- Run Provision on demand for one affected user from the app's Provisioning page: every step should succeed.
- After the next cycle, filter the provisioning logs to that user and to Failure: no new events with the old code.
- For quarantine, the progress bar loses its quarantine message and the audit logs show no new quarantine entry. Remember that a restart runs a full initial cycle, which takes longer.
- For HR inbound to AD, read the object back, for example
Get-ADUser jdoe -Properties manager, title, and compare it with the HR record.
References#
- How to analyze the Microsoft Entra provisioning logs (Microsoft Learn)
- Application provisioning in quarantine status (Microsoft Learn)
- Troubleshoot insufficient access rights error (Microsoft Learn)
- Troubleshoot user update issues with HR provisioning (Microsoft Learn)
- Troubleshoot manager update issues with HR provisioning (Microsoft Learn)
