Azure Cloud Sync Troubleshooting

Cloud synchronization is a critical feature for maintaining seamless data and identity management between on-premises and cloud environments. However, its multiple dependencies and interactions can sometimes lead to challenges. This comprehensive guide will walk you through troubleshooting cloud sync issues, providing actionable steps and insights to resolve them effectively.

Common Cloud Sync Issues and How to Resolve Them

1. Agent Problems

One of the first steps in troubleshooting is verifying the provisioning agent installation and functionality. Key areas to check include:

Is the agent installed and running locally?
Is it visible in the Microsoft Entra admin center?
Is the agent marked as healthy?

Steps to Verify the Agent:

Sign in to the Microsoft Entra admin center as a Hybrid Administrator.
Navigate to Identity > Hybrid Management > Microsoft Entra Connect > Cloud Sync.
Select Cloud Sync and confirm the agent’s status as active (green).

2. Network Configuration Checks

Ensure the provisioning agent can communicate with Azure datacenters. This involves verifying open ports and URL access:

Ports:
- Port 80: For downloading certificate revocation lists (CRLs).
- Port 443: For outbound communication with the Application Proxy service.
URLs: Allow access to key URLs such as *.msappproxy.net and *.servicebus.windows.net.

Firewall Configuration Tips: If your firewall supports domain-based rules, configure access based on domain suffixes. Otherwise, ensure Azure IP ranges and service tags are allowed.

3. Agent Installation Problems

Common Issues:

Agent Failed to Start: This may occur due to group policy restrictions.
- Resolution:
  1. Open Services (Start > Run > services.msc).
  2. Update the agent log-on account to a domain admin and restart the service.

Certificate Errors: These typically result from connectivity issues.
- Resolution: Configure an outbound proxy in the agent’s .config file.

4. Object Synchronization Errors

Synchronization issues can manifest as skipped objects or provisioning failures. Use the provisioning logs in the Microsoft Entra admin center to:

Filter logs by date or ObjectGuid.
Identify where synchronization fails and pinpoint specific issues.

Skipped Objects: Some objects may be excluded due to scoping rules, such as:

Critical system objects set to TRUE.
Replication victim objects.

Resolution: Check provisioning logs for skipped statuses and adjust scoping rules as needed.

5. Quarantine State for Provisioning Jobs

Provisioning jobs may enter quarantine if repeated errors occur. To resolve:

Clear the quarantine via the Microsoft Entra admin center or restart the provisioning job.

Screenshot that shows the quarantine status.

Use Microsoft Graph API for detailed control over synchronization restarts.
Alternatively, you can use Microsoft Graph to restart the provisioning job. You have full control over what you restart. You can choose to clear:
Escrows, to restart the escrow counter that accrues toward quarantine status.
Quarantine, to remove the application from quarantine.
Use the following request:
POST /servicePrincipals/{id}/synchronization/jobs/{jobId}/restart

6. Password Writeback Issues

Password writeback enables seamless password updates across environments but may fail due to:

Missing gMSA permissions.
Disabled inheritance in AD DS.
On-premises password policies blocking resets.

Resolution:

Verify gMSA permissions and ensure inheritance is enabled.
Update group policies to accommodate password writeback.
Use gpupdate /force for immediate policy updates.

Advanced Troubleshooting Tips

Log File Analysis

Leverage trace logs for deeper insights:

Default log location: C:\ProgramData\Microsoft\Azure AD Connect Provisioning Agent\Trace
Use the AADCloudSyncTools PowerShell module for detailed log exports.

Resolving Agent Registration Errors

Errors during agent registration are often linked to PowerShell execution policies. Ensure policies are set to RemoteSigned or Undefined to prevent issues.

Disabling Accidental Deletion Prevention

For bulk object deletions, use the Disable-AADCloudSyncToolsDirSyncAccidentalDeletionPrevention PowerShell command to bypass deletion blocks after confirming they are intentional.

Key Takeaways for Successful Cloud Sync

Regularly monitor the health of your provisioning agents and configurations.
Maintain up-to-date firewall rules and network configurations.
Use Microsoft Entra admin center tools and logs for real-time troubleshooting.
Leverage PowerShell modules like AADCloudSyncTools for advanced configurations and repairs.