How to identify DirSync or Azure AD Connect provisioning errors in Office 365

Applies to: Exchange Online

Summary


This article describes how to identify directory synchronization (DirSync) or Azure Active Directory (Azure AD) Connect provisioning errors in Microsoft Office 365. 

More Information


You can check the status in the Microsoft 365 admin center. If there are no errors present, the DirSync or Azure AD Connect Status icon appears as a green circle (successful). 

A screenshot of DirSync Status that shows green

If errors are present, the DirSync or Azure AD Connect Status icon appears as an orange triangle, and the entry includes a "We found DirSync object errors" message link that points to more information. 

A screenshot of DirSync Status that shows error

After you click We found DirSync object errors, all errors that exist in the environment are listed. 

A screenshot of all the error listed

Click each error entry for more information.

In the following example, a proxy address that belongs to Mia.Pugliesi@contoso.com is added as a proxy address to another user, lbudai@contoso.com.

This example states that the Mia.Pugliesi@contoso.com proxy address is removed automatically. This removal means that the Dirsync or Azure AD Connect process doesn't let the change of proxy addresses be synced to Azure and Exchange. However, the source Active Directory Domain Services (AD DS) that must be corrected to make the object healthy is not changed. If the proxy address is not changed in the source AD DS, the error persists, as shown in the following screen shot. 

A screenshot of the conflict error example

Unless this error is for a new user who was not provisioned, existing objects may not be affected by this issue. However, this error may affect your ability to do other things with the object. For example, if you try to change licensing, you see the following error message. 

A screenshot of the Product licenses error message

You can also view this error by using the following cmdlet in Azure AD PowerShell:

Get-MsolDirSyncProvisioningError -ErrorCategory PropertyConflict

This example indicates only which object has an issue. It does not include the conflicting object. The results may vary, depending on the error. For example, the result resembles the following: 

ExtensionData      : System.Runtime.Serialization.ExtensionDataObjectDisplayName        : Liza BudaiImmutableId        : ImmutableIdLastDirSyncTime    : Date/TimeObjectId           : ObjectIdObjectType         : UserProvisioningErrors : {ProxyAddresses}ProxyAddresses     : {smtp:lbudai@contoso.com, smtp:lbudai@contoso.mail.onmicrosoft.com}UserPrincipalName  : lbudai@contoso.com

For more information see:

You see validation errors for users in the Office 365 portal or in the Azure Active Directory Module for Windows PowerShell


Additionally, a report is sent to the technical tenant contact with similar information when an error occurs. The report resembles the following screen shot. If you need to update the email address of the person who recieives this notification, you can edit it by giong to the M365 Admin Center -> Settings -> Organization profile.

If you need to add multiple people, consider using a distribution list or setting up an inbox or transport rule to forward to a set of users or distribution list to widen the audience.

A screenshot of the report

Review the object in the source AD DS, and take the necessary action to resolve the issue. In this case, you can see that the duplicate proxy address is added to Liza’s account. This is clearly a mistake, and the duplicate proxy address can be removed.

Active_directory2

The error may not always be so clear. These kinds of errors can be triggered by your business processes that may include employees leaving and returning, name changes, mergers and acquisitions, and so on. In these cases, the duplicate objects appear to be valid. However, you should do a detailed review to locate and resolve the difference. Microsoft does not have access to your AD DS source. Therefore, your assistance will be necessary to resolve the issue.