In this article
This article covers common issues with Microsoft Entra Identity Connections, including provisioning not starting, users not syncing, policy not applying, and connection status errors.
Understanding the two status surfaces
Identity Connections display status in two locations that measure different things. It is normal for these to not match exactly.
The Identity Connections grid reflects what DNSFilter has received from the directory—whether users and groups have synced and whether a recent error occurred on the DNSFilter side.
The connection detail page—accessed through the Edit menu—reflects what Entra reports about its own provisioning job.
A connection can show Connected in the grid because users synced previously, while the detail page shows a more recent issue. When the two disagree, the detail page reflects the most current state of the Entra provisioning job.
Use the grid status for a quick DNSFilter health check and the detail page for accurate Entra current state.
See Manage Identity Connections for a full description of grid statuses.
Entra provisioning status
The connection detail page displays provisioning status reported directly by Microsoft Entra. These tables describe each status and the steps to resolve it if necessary.
Overall connection state
| Status | Description | Steps to resolve |
|---|---|---|
| Active | The connection is running normally and syncing on schedule | No action needed |
| In progress | A sync cycle is currently running | Wait for the cycle to complete |
| Not started | The provisioning job has not started. Provisioning normally starts automatically when the connection is created, so this state is unexpected | If it persists, delete the connection and create a new one |
| Not configured |
Setup is incomplete because the provisioning scope is empty. Scope is populated automatically from Collection membership, so no Collection has been saved for this connection yet |
In DNSFilter, create or open a Collection, add the applicable users and groups, select this connection as the Source, and save. DNSFilter updates the Entra scope automatically |
| Paused | Provisioning was stopped | In Entra, select Start provisioning to resume |
| Quarantine | Entra has paused syncing due to repeated failures | Review the quarantine reason in the detail page, resolve the underlying issue, then restart provisioning |
| Quarantine expired | Entra stopped retrying after an extended period of failures. Admin action is required | Resolve the underlying issue, then delete the connection and create a new one |
Last sync result
| Status | Description | Steps to resolve |
|---|---|---|
| Succeeded | The last sync cycle completed with no errors | No action needed |
| Completed with retries | The sync completed but some items are queued for retry on the next cycle | No action needed. This typically clears on the next cycle. If it persists, review the quarantine reason table below |
| Completed as expected | The sync completed; some items are waiting on related data and will resolve on the next cycle | No action needed—this is expected behavior |
| In progress | The sync cycle is still running | Wait for the cycle to complete |
| Failed | The last sync cycle ended with errors | Review the error message on the detail page, then check the quarantine reason table below |
| Paused / Disabled | The sync was skipped because provisioning is turned off | Restart provisioning in Entra if this was not intentional |
Quarantine reasons
| Reason | Description | Steps to resolve |
|---|---|---|
| Invalid credentials or unreachable endpoint | Entra cannot reach DNSFilter—typically a lost or invalid connection key | Delete the connection and create a new one. The connection key is shown only once during setup; if it is lost, recreating the connection is the correct fix |
| Too many items failing | More than 40% of users or groups in the sync scope are failing | Review which users or groups are failing in Entra provisioning logs. Correct the source data in Entra and restart provisioning |
| Manually quarantined by Microsoft | Microsoft paused the connection on their side | Contact Microsoft support if this does not clear on its own |
✍️ Identity Connections cannot be re-authorized in place. If a credential or authorization issue cannot be resolved by restarting provisioning, delete the connection and create a new one. Deleting a connection removes all associated provisioned users and groups.
Provisioning has not started after creating a connection
Provisioning starts automatically when an Identity Connection is created. If the detail page shows Not started or Not configured, the usual cause is that no Collection has been saved for the connection yet, so the provisioning scope is empty.
To start syncing:
- From the DNSFilter dashboard, navigate to Identities and select Collections
- Create or open a Collection
- From the Source dropdown, select the Identity Connection
- Add the applicable users and groups as Collection members
- Select Save
DNSFilter updates the Entra provisioning scope automatically. The first sync may take up to 40 minutes, and larger directories may take longer.
Users are not appearing after provisioning starts
Check the following:
- The provisioning scope is empty. Scope is populated from Collection membership, so confirm the users or groups have been added to a saved Collection that uses this connection. Allow up to 40 minutes for the next cycle to complete
- The first sync is still running. The initial sync can take considerably longer than incremental syncs, particularly for large directories. Allow sufficient time before troubleshooting
- The members were added but not saved. Collection membership updates the Entra scope only when the Collection is saved
Policy is not applying to a user
Check the following in order:
- Confirm the user is a member of a saved Collection that uses this connection. Collection membership determines what Entra provisions
- Confirm the user has synced—check the Users page in DNSFilter for the user's record
- Confirm an active Roaming Client session exists on the device—Entra provisioning alone does not apply policies. An active Roaming Client session is required for policy assignment to take effect
- Check whether the user has a direct policy set at the user level—from the DNSFilter dashboard, navigate to Identities and select Users, then filter by Has direct policy. A direct policy overrides Collection-level assignment
Nested groups are not syncing as expected
Entra does not provision nested groups. Selecting a parent group does not automatically include groups nested inside it. This is a Microsoft constraint and cannot be changed.
All groups, including nested ones, appear individually in the Collection member picker. Add each nested group individually to the Collection to include its members. If the member count shown for a group is lower than expected, nested groups are the likely cause.
For organizations with complex directory structures, Entra dynamic groups are the Microsoft-recommended solution. Dynamic groups use rules-based membership that populates as a flat group and syncs cleanly.
Comments
0 comments
Please sign in to leave a comment.