Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

• SailPoint Identity Services Documentation
• SailPoint Support Knowledge Base
• SailPoint Developer Community

Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to Managing Additional Settings.

Exception Occurred in Iterate Objects - populateRiskyUsersDetails

This error occurs when the Risky User feature is disabled in Microsoft Entra ID.

Resolution: Choose one of the following solutions to complete account aggregation:

Option 1: Delete these four attributes from the connector's Account Schema:

• riskLevel
• riskState
• riskDetail
• riskLastUpdatedDateTime

Option 2: Grant the necessary permission to read Risky User Alerts in Entra ID.

Provisioning Fails With a 409 Conflict Error for License Assignment Requests

When a provisioning plan includes requests to add multiple assignedLicence values for a single user, the operation fails returning an API error code of 409. This occurs because the Microsoft cannot process simultaneous license assignment requests for the same user, treating it as a concurrency conflict.

Resolution: To resolve this issue, you can configure the connector to automatically retry the failed license assignment request. This allows a brief delay for the Microsoft tenant to process the initial request before the connector attempts the operation again. For more information, refer to Configuring Errors and Retries.

Attributes Are Not Updated With Null Values During Provisioning

Resolution: Specify the attributes whose values you want to set as null to the source under the supportNullValueForAttributes using PATCH method.

In the following example, the department and jobTitle attributes are specified, indicating that these attributes should be updated with null values during provisioning.

[
  {
    "op": "add",
    "path": "/connectorAttributes/supportNullValueForAttributes",
    "value": [
            "department",
            "jobTitle"
        ]
  }
]

Numeric Value Displayed for SPN Account Names

When managing users and Service Principal Names (SPNs) as accounts under a single source, if the displayName attribute of the Account Schema is set to UserPrincipalName, you may encounter numeric values for SPN accounts instead of readable names. Resolution: To display the correct SPN displayName, ensure that the mapSPNDisplayNameToUPN is added to the source XML using PATCH and set the value to true. For example,

[
    {
        "op": "add",
        "path": "/connectorAttributes/mapSPNDisplayNameToUPN",
        "value": true
    }
]

400 Bad Request on Microsoft Graph API Filter

Resolution: Replace dirSyncEnabled with onPremisesSyncEnabled to check if a user is synced from on-premises directory.

For example, onPremisesSyncEnabled eq true

Aggregation Fails With AxiosError Timeout of 120000ms

AxiosError: timeout of 120000ms exceeded

Resolution: To resolve HTTP request timeout errors during aggregation, increase the connector timeout duration by adding the httpRequestTimeout attribute to the source configuration using the REST API. The attribute is an integer specified in seconds. The default value is 120 seconds. For example,

[
    {
        "op": "add",
        "path": "/connectorAttributes/httpRequestTimeout",
        "value": 180
    }
]

Create Account Fails With Command Inactive for 10m0s

Account creation can fail when the create command stays inactive for 10 minutes. The parsed error can also report HTTP 400 because another object already uses the same userPrincipalName. The post-create getObject call re-fetches large amounts of data, such as Privileged Identity Management (PIM) data, from Microsoft Graph. That call can fail or slow account creation even after the user account is provisioned.

[ConnectorError] command inactive for 10m0s std:account:create

Another object with the same value for property userPrincipalName already exists.

Resolution: Add the skipGetObjectOnCreateAccount attribute to the source using the REST API and set the value to true. When this attribute is true, account creation returns the attributes from the create request and does not call getObject after the account is created.

[
    {
        "op": "add",
        "path": "/connectorAttributes/skipGetObjectOnCreateAccount",
        "value": true
    }
]

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.