Summary
This article describes how to identify directory synchronization (DirSync) or Azure Active Directory (Azure AD) Connect provisioning errors in Microsoft Office 365.
More Information
You can check the status in the Microsoft 365 admin center. If there are no errors present, the DirSync or Azure AD Connect Status icon appears as a green circle (successful).
If errors are present, the DirSync or Azure AD Connect Status icon appears as an orange triangle, and the entry includes a "We found DirSync object errors" message link that points to more information.
After you click We found DirSync object errors, all errors that exist in the environment are listed.
Click each error entry for more information.
In the following example, a proxy address that belongs to Mia.Pugliesi@contoso.com is added as a proxy address to another user, lbudai@contoso.com.
This example states that the Mia.Pugliesi@contoso.com proxy address is removed automatically. This removal means that the Dirsync or Azure AD Connect process doesn't let the change of proxy addresses be synced to Azure and Exchange. However, the source Active Directory Domain Services (AD DS) that must be corrected to make the object healthy is not changed. If the proxy address is not changed in the source AD DS, the error persists, as shown in the following screen shot.
Unless this error is for a new user who was not provisioned, existing objects may not be affected by this issue. However, this error may affect your ability to do other things with the object. For example, if you try to change licensing, you see the following error message.
You can also view this error by using the following cmdlet in Azure AD PowerShell:
Get-MsolDirSyncProvisioningError -ErrorCategory PropertyConflict
This example indicates only which object has an issue. It does not include the conflicting object. The results may vary, depending on the error. For example, the result resembles the following:
ExtensionData : System.Runtime.Serialization.ExtensionDataObject
DisplayName : Liza Budai
ImmutableId : ImmutableId
LastDirSyncTime : Date/Time
ObjectId : ObjectId
ObjectType : User
ProvisioningErrors : {ProxyAddresses}
ProxyAddresses : {smtp:lbudai@contoso.com, smtp:lbudai@contoso.mail.onmicrosoft.com}
UserPrincipalName : lbudai@contoso.comFor more information see:
You see validation errors for users in the Office 365 portal or in the Azure Active Directory Module for Windows PowerShell
Additionally, a report is sent to the technical tenant contact with similar information when an error occurs. The report resembles the following screen shot. If you need to update the email address of the person who recieives this notification, you can edit it by giong to the M365 Admin Center -> Settings -> Organization profile.
If you need to add multiple people, consider using a distribution list or setting up an inbox or transport rule to forward to a set of users or distribution list to widen the audience.
Review the object in the source AD DS, and take the necessary action to resolve the issue. In this case, you can see that the duplicate proxy address is added to Liza’s account. This is clearly a mistake, and the duplicate proxy address can be removed.
The error may not always be so clear. These kinds of errors can be triggered by your business processes that may include employees leaving and returning, name changes, mergers and acquisitions, and so on. In these cases, the duplicate objects appear to be valid. However, you should do a detailed review to locate and resolve the difference. Microsoft does not have access to your AD DS source. Therefore, your assistance will be necessary to resolve the issue.
Reference
For more information, see the following Office and Azure articles:
