If an object is not syncing with Microsoft Azure Active Directory (Azure AD) as expected, it can be for several reasons. If you received an error message from Azure AD or see an error in Azure AD Connect Health, read onFix errors during syncInstead. But if you're troubleshooting a non-Azure AD object, this article is for you. Describes how to find synchronization errors in the on-premises Azure AD Connect component.
If you are deploying Azure AD Connect version 1.1.749.0 or later, useproblem solving taskin the Object Synchronization Troubleshooting Wizard.
Before we explore the synchronization issues, let's take a look at the Azure AD Connect synchronization process:
- CS:Shared space, table in the database
- S N:Metaverse, a table in the database
The synchronization process includes the following steps:
Import from AD:Active Directory objects are moved to Active Directory CS.
Import from Azure AD:Azure AD objects are moved to Azure AD CS.
Synchronization:Inbound sync rules and outbound sync rules are run in order of priority, from lowest to highest. To view sync rules, go to the sync rules editor from the desktop apps. Inbound synchronization rules move data from CS to MV. Outbound synchronization rules move data from MV to CS.
Export to AD:After synchronization, objects are exported from Active Directory CS to Active Directory.
Export to Azure AD:After synchronization, objects are exported from Azure AD CS to Azure AD.
Solve the problem
To find errors, look in several different places in the following order:
- Fromwork diariesfind errors identified by the synchronization engine during import and synchronization.
- Fromplace for the connectorfind missing objects and sync errors.
- Frommetauniverzumfind problems with the data.
StartSync service errorbefore starting these steps.
FromActivitiesThe Sync Services Manager tab is where you should start troubleshooting. This tab displays the results of recent edits.
The upper halfActivitiesThe tab displays all waveforms in chronological order. By default, the activity log tracks data for the last seven days, but you can change this setting usingFrom plans. Look for a waveform that does not show asuccessstatus. You can change the sorting by clicking on the headings.
Fromstatecolumn contains the most important information and shows the most serious problem to run. Here is a quick summary of the most common conditions in order of research priority (where * represents multiple possible error sequences).
|arrested-*||The flight could not be completed. This can happen, for example, if the remote system crashes and cannot be contacted.|
|stuck error limit||There are more than 5000 errors Execution has been automatically stopped due to a large number of errors.|
|completed* errors||The build is complete, but there are errors (less than 5000) that need to be investigated.|
|completed-*-warnings||The build completed successfully, but some data is not in the expected state. If you have errors, this message is usually just a symptom. Do not investigate warnings until you have corrected the errors.|
When the row is selected, the lower partActivitiesthe map is updated to show the details of that waveform. To the left of this area may be a list of titlesstep #. This list only appears if there are multiple domains in the forest and each domain is represented by a step. You can find the domain name under the titleSeptum. FulaniSynchronization statisticsyou will find more information about the number of processed changes. Select the links for the list of changed objects. If you have objects with errors, those errors will appear belowSync errorscolumn.
Errors in the Operations tab
When an error occurs, Sync Service Manager displays both the object with the error and the error itself as links that provide more information.
Start by selecting an error string. (In the image above, the error string isfeature triggered by a sync rule error.) First, an overview of the object is displayed. Select to see the actual errorTracking stack. This trace contains information about the error at the debug level.
Right clickCall for stack informationfield, clickSelect alland then selectCopy. Then copy the stack and inspect the error in your favorite editor such as Notepad.
If the error comes fromSyncRulesEngine, the call stack information first lists all of the object's attributes. Scroll down until you see the headerinner exception =>.
The line after the header shows the error. In the image above, the error comes from a custom sync rule created by Fabrikam.
If the error doesn't provide enough information, it's time to look at the data itself. Select the Object ID link and continue troubleshootingimported connector spatial object.
Connector Spatial Object Properties
IActivitiestab shows no errors, follow the spatial connector object from Active Directory to the metaverse to Azure AD. You should find a trouble spot on this path.
Find an object in CS
In Synchronization, select Service ManagerConnections, select the Active Directory connector and selectSearch the connecting room.
wReachfield, select itRDNto search by CN attribute or selectDN cancerwhen you want to searchelegant nameattribute. Enter a value and selectis looking for.
If you can't find what you're looking for, it may have been filtereddomain based filteringLubOU-based filtering. Read on to verify that filtering is configured as expectedAzure AD Connect Sync - Configure filtering.
You can perform another useful search by selecting the Azure AD connector. UReachfield, select itWaiting for importand then selectTo addcheckbox. This search includes all synchronized objects in Azure AD that cannot be linked to an on-premises object.
These objects were created by another synchronization engine or by a synchronization engine with a different filter configuration. These abandoned facilities are no longer managed. Review this list and consider removing these objects fromAzure AD-PowerShellcmdleti.
When you open the CS object, there are several tabs at the top. TheImportshows the data set after import.
Fromold valuecolumn shows what is currently stored in Connect, aNew valuecolumn shows what has been received from the source system and not yet applied. If there is an error in the object, the changes will not be processed.
FromSync errortab is visible inConnector Spatial Object Propertieswindow only when there is a problem with the object. See how to do this for more informationFix sync errors in the Operations tab.
Fromdisasterbookmark wConnector Spatial Object Propertiesthe window shows how the spatial connector object is connected to the reverse object. You can see when the connector last imported a change from the connected system and what rules were used to populate the data in the metaverse.
In the previous pictureActioncolumn shows the rule for synchronizing incoming traffic with the actionPoluga. This means that as long as this spatial connector object is present, the reverse object will exist. Instead, if the synchronization rule list contains a synchronization rule for outgoing traffic from aPolugathis object will be deleted when the reverse object is deleted.
You can also see in the picture aboveSynchronization of passwordscolumn that input connector space can contribute to password changes since one sync rule has this valueWHERE. This password is sent to Azure AD via an outbound rule.
Combidisastertab, you can go to Metaverse by selectingProperties of metaversal objects.
In the lower left cornerConnector Spatial Object Propertiesit's a windowNoticebutton. Select this button to openNoticepage with which one object can be synchronized. This page is useful if you are troubleshooting some custom synchronization rules and want to see the impact of a change on a single object. You can chooseFull synchronizationfromdelta synchronization. You can also chooseGenerate one examplewhich only retains the change in memory. Or chooseApprove the sample, which updates the metaverse and sets any changes to destination connector spaces.
In the example, you can inspect the object and see which rule has been applied to a particular attribute stream.
NearNoticebutton, selectlogbutton to openlogpage. Here you can see the status and history of password synchronization. For more information seeFix password hash sync issues with Azure AD Connect sync.
It is usually better to start your search from the source part of the Active Directory connector. But you can also start your quest from the metaverse.
Find an object in MV
In Synchronization, select Service ManagerFind metaversesas in the picture below. Create a query that you know will find the user. Look for common attributes likeaccountnaam(sAMANazwa konta) andprimary_username. For more information seeSynchroniseer Service Manager Metaverse Search.
wSearch resultsclick on an item.
If you haven't found the object, it means it hasn't arrived in the Metaverse yet. Continue searching for the object in Active Directoryplace for the connector. If you find an object in the Active Directory connector space, there may be a synchronization error preventing the object from being moved to the metaverse, or a synchronization rule scope filter may be applied.
Object not found in MV
If the object is in Active Directory CS but not in MV, the scope filter is applied. To see the range filter, go to the desktop application menu and selectSync rule editor. Filter the rules that apply to the object by adjusting the filter below.
Look and check each rule in the list aboverange filter. In the following filter range, ifisCriticalSystemObjectvalue is NULL, FALSE, or empty, is in the range.
To goSee CSattribute list and check which filter blocks the feature from going to MV. TheConnector spacethe attribute list displays only non-null and non-empty attributes. For exampleisCriticalSystemObjectnot listed, the value of this attribute is null or empty.
Object not found in Azure AD CS
If the object is not present in the Azure AD connector space but is present in the MV, look at the output rule scope filter of the corresponding connector region and verify that the object is filtered becauseMV attributesdo not meet the criteria.
To view the outgoing range filter, select the appropriate rows for the object by setting the filter below. List each line and look at the appropriate oneAtrybut MVvalue.
Alattributeson the map you can see the values and connectors that contributed to it.
If the object is not syncing, ask the following questions about attribute states in the Metaverse:
- That's an attributecloud filteredpresent and set upWHERE? If so, it is filtered according to the steps inattribute-based filtering.
- That's an attributemost AnkerRight now? If not, do you have a forest topology for account resources? If the object is identified as a linked mailbox (attributemsExchRecipientTypeDetailshas value2),most Ankerit is provided by an Active Directory account-enabled forest. Make sure the main account is correctly imported and synced. The main account must be specifiedconnectorsfor the object.
FromConnectionsthe tab displays all connection spaces that have an object view.
You should have a link to:
- Any Active Directory forest in which the user is represented. This representation may includeForeign primary securityandContactobject.
- Azure AD connector.
If you are missing the Azure AD connector, see the section aboutMV attributesto verify the Azure AD provisioning criteria.
CombiConnectionsmark wherever you can goconnector spatial object. Select a row and clickproperty.
- Learn more aboutAzure AD Connect synchronization.
- Learn more abouthybrid identity.
Start the Azure AD Connect wizard. Go to Additional Tasks > Troubleshoot, and then select Next. On the Troubleshooting page, select Launch to start the troubleshooting menu in PowerShell. In the main menu, select Troubleshoot Object Synchronization.How do I force Active Directory to sync with Azure? ›
- Use the Enter-PSSession command to connect to your Azure AD Connect server.
- Perform a delta synchronization using the Start-ADSyncSyncCycle command.
- Exit the PSSession to kill the connection to your Azure AD Connect server.
- Remove the Azure AD account (owner) from all admin roles.
- Hard delete the quarantined object in the cloud.
- The next sync cycle will take care of soft-matching the on-premises user to the cloud account because the cloud user is now no longer a Hybrid Identity Administrator.
- Open Azure AD Connect.
- Open Manage Azure AD cloud sync.
- Select your configuration (domain)
- Click Start or Restart Sync.
Azure AD Connect Cloud Sync is a new offering from Microsoft designed to meet and accomplish your hybrid identity goals for synchronization of users, groups, and contacts to Azure AD. It accomplishes this by using the Azure AD Cloud provisioning agent instead of the Azure AD Connect application.How do I stop synchronization error? ›
- Check Your Internet Connection.
- Refresh Your Google Drive App.
- Force Stop and Relaunch Google Drive.
- Ensure Google Drive Can Sync Files on Cellular Data.
- Restart Your Android Phone to Get Rid of the Drive Sync Error.
Sign in to the Microsoft 365 admin center with a global administrator account. On the Home page, you'll see the User management card. On the card, choose Sync errors under Azure AD Connect to see the errors on the Directory sync errors page.How to synchronise on-premises Active Directory objects to Azure Active Directory? ›
- Create on-premises AD user object. ...
- Force Azure AD sync. ...
- Check Azure AD Connect synchronization service. ...
- Verify AD object sync status. ...
- Verify objectGUID and ImmutableID attribute. ...
- Make cloud mailbox visible in Exchange on-premises.
Go to Windows Service Control Manager (START → Services). Select Microsoft Azure AD Sync and click Restart.How do I force refresh Active Directory? ›
- Open the Active Directory Schema snap-in.
- In the left pane, click on Active Directory Schema.
- Right-click on the label and select Reload the Schema.
Most attributes of the user accounts, such as the User Principal Name (UPN) and security identifier (SID), are synchronized. However, the following objects and attributes are NOT synchronized: Any objects and attributes you specifically exclude from the sync. SidHistory attributes for users and groups.Which actions can you perform with Microsoft Azure Active Directory Sync? ›
Microsoft AAD Connect can connect to multiple on-premises forests and can exchange organizations and synchronized the customer defined attributes but cannot use Forefront Identity Management synchronization rules.What feature do you need to configure so that objects synchronize from Azure AD to your on-premises AD DS? ›
If you configure writeback, changes from Azure AD are synchronized back to the on-premises AD DS environment. For example, if a user changes their password using Azure AD self-service password management, the password is updated back in the on-premises AD DS environment.What are the requirements to solve synchronization problem? ›
- Mutual Exclusion. Out of a group of cooperating processes, only one process can be in its critical section at a given point of time.
- Progress. ...
- Bounded Waiting.
Try switching off the device, resetting it or removing the battery, then trying again. Make sure you are using the manufacturer's cable. Make sure you correctly insert the USB cable in to the device and your vehicle's USB port. Make sure that the device does not have an auto-install program or active security settings.Why is sync not working? ›
You're likely to have sync problems if you're running a buggy build of an app or the software itself. It's even more rampant if you're missing some critical updates. So, to fix your Google Account synchronization problem, ensure your apps (mostly Google) and phone software are up to date.How do I verify Active Directory synchronization? ›
Sign in to the Microsoft 365 admin center and choose DirSync Status on the home page. Alternately, you can go to Users > Active users, and on the Active users page, select the Elipse > Directory synchronization.How often does Azure AD Sync Sync? ›
How Often? Once every 30 minutes, the Azure AD synchronization is triggered, unless it is still processing the last run. Runs generally take less than 10 minutes, but if we need to replace the tool, it can take 2-3 days to get into synchronicity.How do I force sync between AD and Office 365? ›
Force AD Sync Using AD Users & Computers
You must have Easy365Manager installed for this to work. After making the changes to your user account that you want to replicate, select the check box in the bottom left corner of the Office 365 tab: Clicking Apply or OK will force an AD sync immediately.
- Prepare Windows Server to use with Azure File Sync.
- Deploy the Storage Sync Service.
- Install the Azure File Sync agent.
- Register Windows Server with Storage Sync Service.
- Create a sync group and a cloud endpoint.
- Create a server endpoint.
- Optional: Configure firewall and virtual network settings.
The Microsoft Azure AD Sync synchronization service (ADSync) runs on a server in your on-premises environment. The credentials for the service are set by default in the Express installations but may be customized to meet your organizational security requirements.How do I restart Azure Active Directory provisioning? ›
Use the Azure portal to restart the provisioning job. On the application's Provisioning page, select Restart provisioning. This action fully restarts the provisioning service, which can take some time. A full initial cycle will run again, which clears escrows, removes the app from quarantine, and clears any watermarks.How do I reset my Azure Active Directory? ›
Sign in to the Azure portal. Search for and select Azure Active Directory, then select Password reset from the menu on the left side. From the Properties page, under the option Self service password reset enabled, select None. To apply the SSPR change, select Save.How do I fix Active Directory? ›
- Restart the computer. This step is the first (and easiest) option to try. ...
- Install the latest Windows updates. ...
- Update Microsoft Office apps. ...
- Enable file and printer sharing. ...
- Restart the print spooler. ...
- Add the printer to the computer manually.
Fortunately, there is a way to refresh the group memberships without a restart or a log off, by clearing the Kerberos ticket and re-acquiring a new one.How to restore Active Directory command line? ›
- From the Command prompt type "NTDSUTIL" and press "Enter."
- Type "authoritative restore" at the NTDSUTIL. ...
- Type in the text "restore database" at the "authoritative restore" prompt and press "Enter" to make the full Active Directory restore Authoritative.
You can also check the current DirSync in the Azure Active Directory Admin Center. First, log in to the portal. Then, go to Azure Active Directory —> Azure AD Connect. Under the Azure AD Connect sync section, you should see the current status of the directory sync.How do I know if Azure AD sync is working? ›
Sign in to the Microsoft 365 admin center with a global administrator account. On the Home page, you'll see the User management card. On the card, choose Sync errors under Azure AD Connect to see the errors on the Directory sync errors page.What is the synchronization cycle done by Azure AD Connect? ›
By default every 30 minutes a synchronization cycle is run. If you have modified the synchronization cycle you will need to make sure that a synchronization cycle is run at least once every 7 days.Which components are included with Microsoft Azure Active Directory Connect Sync? ›
- Azure AD Connect Health.
- Microsoft SQL Server 2019 Command Line Utilities.
- Microsoft SQL Server 2019 Express LocalDB.
- Microsoft SQL Server 2019 Native Client.
- Microsoft Visual C++ 14 Redistribution Package.
Understand your organization's requirements. Azure AD Connect Cloud Sync is the preferred way to synchronize on-premises AD to Azure AD, assuming you can get by with its limitations. Azure AD Connect provides the most feature-rich synchronization capabilities, including Exchange hybrid support.Which port is used for synchronization AD to Azure AD? ›
The latest Azure AD Connect Health agent versions only require port 443.What is the difference between Delta Sync and full sync in Azure AD Connect? ›
There are two types of sync in Azure Active Directory Connect: delta sync and full sync. A delta syncs synchronizes only the latest changes while a full sync is only necessary when changing Azure AD Connect configuration.How do I force Office 365 to sync with Active Directory? ›
Force AD Sync Using AD Users & Computers
After making the changes to your user account that you want to replicate, select the check box in the bottom left corner of the Office 365 tab: Clicking Apply or OK will force an AD sync immediately.