# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Exception Occurred in Iterate Objects - populateRiskyUsersDetails

This error occurs when the Risky User feature is disabled in Microsoft Entra ID.

**Resolution**: Choose one of the following solutions to complete account aggregation:

Option 1: Delete these four attributes from the connector's Account Schema:

- riskLevel
- riskState
- riskDetail
- riskLastUpdatedDateTime

Option 2: Grant the necessary permission to read Risky User Alerts in Entra ID.

## Provisioning Fails With a 409 Conflict Error for License Assignment Requests

When a provisioning plan includes requests to add multiple assignedLicence values for a single user, the operation fails returning an API error code of 409. This occurs because the Microsoft cannot process simultaneous license assignment requests for the same user, treating it as a concurrency conflict.

**Resolution:** To resolve this issue, you can configure the connector to automatically retry the failed license assignment request. This allows a brief delay for the Microsoft tenant to process the initial request before the connector attempts the operation again. For more information, refer to [Configuring Errors and Retries](<https://documentation.sailpoint.com/saas/help/accounts/loading_data.html?h=retry+error#errors-and-retries>).

## Attributes Are Not Updated With Null Values During Provisioning

**Resolution:** Specify the attributes whose values you want to set as null to the source under the `supportNullValueForAttributes` using PATCH method.

In the following example, the `department` and `jobTitle` attributes are specified, indicating that these attributes should be updated with null values during provisioning.

```text
[
  {
    "op": "add",
    "path": "/connectorAttributes/supportNullValueForAttributes",
    "value": [
            "department",
            "jobTitle"
        ]
  }
]
```

## Numeric Value Displayed for SPN Account Names

When managing users and Service Principal Names (SPNs) as accounts under a single source, if the `displayName` attribute of the Account Schema is set to `UserPrincipalName`, you may encounter numeric values for SPN accounts instead of readable names. **Resolution**: To display the correct SPN displayName, ensure that the `mapSPNDisplayNameToUPN` is added to the source XML using PATCH and set the value to `true`. For example,

```text
[
    {
        "op": "add",
        "path": "/connectorAttributes/mapSPNDisplayNameToUPN",
        "value": true
    }
]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## 400 Bad Request on Microsoft Graph API Filter

**Resolution**: Replace `dirSyncEnabled` with `onPremisesSyncEnabled` to check if a user is synced from on-premises directory.

For example, `onPremisesSyncEnabled eq true`

## Aggregation Fails With AxiosError Timeout of 120000ms

`AxiosError: timeout of 120000ms exceeded`

**Resolution**: To resolve HTTP request timeout errors during aggregation, increase the connector timeout duration by adding the `httpRequestTimeout` attribute to the source configuration using the REST API. The attribute is an integer specified in seconds. The default value is `120` seconds. For example,

```text
[
    {
        "op": "add",
        "path": "/connectorAttributes/httpRequestTimeout",
        "value": 180
    }
]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Create Account Fails With Command Inactive for 10m0s

Account creation can fail when the create command stays inactive for 10 minutes. The parsed error can also report HTTP 400 because another object already uses the same userPrincipalName. The post-create getObject call re-fetches large amounts of data, such as Privileged Identity Management (PIM) data, from Microsoft Graph. That call can fail or slow account creation even after the user account is provisioned.

```text
[ConnectorError] command inactive for 10m0s std:account:create
```

```text
Another object with the same value for property userPrincipalName already exists.
```

**Resolution**: Add the `skipGetObjectOnCreateAccount` attribute to the source using the REST API and set the value to `true`. When this attribute is `true`, account creation returns the attributes from the create request and does not call getObject after the account is created.

```text
[
    {
        "op": "add",
        "path": "/connectorAttributes/skipGetObjectOnCreateAccount",
        "value": true
    }
]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.