ExamFinch.com My Study

Study guide

8.4 Troubleshooting Synchronization

Practice this exam

Microsoft 365 Administrator Expert MS-102

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide

2 Tenant Setup, Domains & Org Settings

2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile

3 Service Health, Network & Software Updates

3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates

4 Adoption, Usage & Microsoft 365 Backup

4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup

5 Users, Contacts, Groups & Shared Mailboxes

5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes

6 Licensing & Bulk User Management

6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell

7 Roles, Admin Units & Privileged Identity Management

7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM

8 Identity Synchronization with Entra Connect

8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization

9 Authentication, SSPR & Password Protection

9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues

10 Identity Protection, Conditional Access & MFA

10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access

11 Defender XDR Posture, Incidents & Threat Intelligence

11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence

12 Defender for Office 365: Policies, Alerts & Investigation

12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats

13 Attack Simulation & Restricted Entities

13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users

14 Defender for Endpoint

14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard

15 Defender for Cloud Apps

15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery

16 Purview Information Protection & Data Lifecycle

16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer

17 Purview Data Loss Prevention

17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports

18 Final Review & Exam Strategy

18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps

8.4 Troubleshooting Synchronization

Key Takeaways Explain This Topic AI

Duplicate attribute resiliency quarantines conflicting objects in Entra ID rather than dropping them, but the source conflict still has to be fixed in on-prem AD

Soft-match uses mail/UPN to relink a deleted user to a restored cloud object; hard-match uses immutableId when the cloud object already exists

An OU removed from sync scope does not delete the already-synced cloud objects — they become orphaned and require manual deletion or a scoping change

Cloud Sync places a configuration into quarantine after repeated errors; clearing quarantine requires fixing the root cause and then restarting provisioning

The Synchronization Service Manager (Connect Sync) and the Entra provisioning logs (Cloud Sync) are the primary diagnostic surfaces for object-level failures

Last updated: August 2026

Troubleshooting Synchronization

Quick Answer: Most sync failures resolve to a small set of causes: duplicate attribute conflicts, invalid attribute values, filtering mistakes, accidental deletes, and provisioning/quarantine states. Use duplicate attribute resiliency and the fix sync errors tasks in the Entra admin center to remediate conflicts, and use the Synchronization Service Manager (Connect Sync) or the provisioning logs (Cloud Sync) to diagnose object-level failures.

Duplicate Attribute Conflicts

The most common sync error is a duplicate attribute conflict — two on-prem objects claim the same value for an attribute that Entra ID requires to be unique, usually userPrincipalName or proxyAddresses .

Duplicate attribute resiliency is a Microsoft Entra ID feature that quarantines the conflicting attribute on the duplicate object instead of dropping the object. The first object keeps the value; the second object is provisioned with the conflicting value blanked or quarantined, and a sync error is raised. Resiliency prevents data loss but does not resolve the conflict — you must fix the source.

Resolution:

  • Identify the conflict from the Connect Health object-level error or the Cloud Sync provisioning log
  • Edit one of the two on-prem objects so it has a unique value
  • Run a delta sync (Connect Sync) or wait for the next Cloud Sync cycle
  • The sync engine retries the quarantined attribute and clears the error once the values are unique
  • Large-Object and Invalid-Attribute Errors

Large-object errors ( LargeObject ) occur when an attribute exceeds the sync engine's limit — for example, a userCertificate or thumbnailPhoto larger than the allowed size. Fix by trimming the offending attribute on the source object.

Invalid attribute values ( InvalidAttribute ) occur when a value fails validation — a malformed UPN, an unsupported character, or a value that violates the Entra schema. Fix the value in AD, then re-sync.

Filtering Mistakes

A common operational mistake is removing an OU from sync scope and expecting the previously synchronized objects to disappear from Entra ID. They do not — once an object has been synced, removing its container from scope stops updates but does not delete the cloud copy. The cloud object is now orphaned : it will not receive attribute updates, and the source-of-truth link is effectively broken.

Resolution options:

Re-add the OU to scope and then properly deprovision the users (for example, by disabling and letting the next cycle flow the disable state)

  • Manually delete the orphaned cloud objects in the Entra admin center if they should not exist
  • Use the fix sync errors task in the Entra admin center, which can guide removal of orphaned objects
  • Restoring Accidentally Deleted Users: Soft-Match vs Hard-Match

When an on-prem user is accidentally deleted and recreated, or when a cloud-only user needs to be relinked to a new on-prem identity, you use matching to re-establish the link:

Soft-match — the sync engine matches on mail or userPrincipalName . If a deleted on-prem user is recreated with the same UPN and mail, the sync engine soft-matches the new on-prem object to the existing cloud object and resumes updates.

Hard-match — the sync engine matches on immutableId (the sourceAnchor). Use hard-match when the cloud object already exists and you have the original sourceAnchor value; set the sourceAnchor on the new on-prem object to the original and the engine hard-matches.

Soft-match is the easier path when the original anchor is unavailable; hard-match is the deterministic path when you can recover the anchor.

Provisioning and Quarantine States (Cloud Sync)

Cloud Sync places a configuration into quarantine after repeated errors. Common triggers:

  • Invalid provisioning agent credentials
  • A sustained burst of duplicate-attribute conflicts
  • Loss of connectivity to the on-prem AD
  • A bad scoping filter that produces no valid objects

While in quarantine, Cloud Sync pauses provisioning. Clearing quarantine requires fixing the root cause and then restarting provisioning on the configuration from the Entra admin center. The provisioning page shows the quarantine reason; the provisioning logs show the failing objects.

Diagnostic Surfaces

Engine Primary diagnostic surface What it shows

Connect Sync Synchronization Service Manager ( miisclient.exe ) Connector space objects, sync steps, flow errors, join/disconnect status

  • Connect Sync Connect Health portal Sync statistics, object-level errors, alert history
  • Cloud Sync Entra admin center Provisioning page Configuration status, quarantine state, last cycle time
  • Cloud Sync Provisioning logs Per-object create/update/disable/fail events with reason
  • Troubleshooting Table
  • Symptom Likely cause Fix
  • DuplicateUPN sync error Two on-prem objects share a UPN Reassign a unique UPN to one object; run delta sync

DuplicateProxyAddress sync error Two mailboxes share an SMTP address Remove the duplicate proxyAddresses value from the object that should not own it

LargeObject error on a user An attribute (often userCertificate or thumbnailPhoto ) exceeds the size limit Trim the oversized attribute on the source object

Orphaned cloud objects after OU removal Removing a synced OU from scope stops updates but does not delete cloud copies Re-add the OU and deprovision properly, or manually delete the orphaned cloud objects

Deleted user reappeared without attributes Source object was deleted and recreated; link not re-established Soft-match on UPN/mail, or hard-match on immutableId, then re-sync

Cloud Sync configuration quarantined Repeated errors (bad credentials, conflict storm, lost connectivity) Fix the root cause shown on the Provisioning page, then restart provisioning

InvalidAttribute validation error Malformed UPN, unsupported character, or schema violation Correct the value in AD; run a delta sync

No objects syncing after a change Filtering or scoping change removed all valid objects Verify domain/OU/group scoping; restore the intended scope

Using the Fix Sync Errors Tasks

The Entra admin center exposes fix sync errors tasks that operationalize the most common remediations:

Duplicate attribute resiliency — surfaces quarantined attributes so you can review and release them once the source is fixed

  • Orphaned object cleanup — helps identify cloud objects whose source link is broken
  • Group-based filtering review — verifies that pilot scoping still includes the intended users

Use these tasks as a first stop before drilling into Connect Health or the provisioning logs — they often localize the problem in one click.