Azure Teams Group - Provisioning Errors - Owner Not Found

IdentityIQ (IIQ) IIQ Discussion and Questions
, , ,
1

IIQ Development Issue Report

Which IIQ version are you inquiring about?

8.5p2

Please share any images or screenshots, if relevant.

[Screenshot showing provisioning errors:

  • Error ID: 127281288 - “Team activation for group failed : Team owner not found for group [GROUP_ID]”
  • Error ID: 127281285 - “Response Code - 400 Error - 400 Team owner not found for group [GROUP_ID]”]

Please share any other relevant files that may be required (for example, logs).

Provisioning Plan XML:

<ProvisioningPlan>
  <ObjectRequest application="Azure" op="Create" type="group">
    <AttributeRequest name="teamsEnabled" op="Set">
      <Value>
        <Boolean>true</Boolean>
      </Value>
    </AttributeRequest>
    <AttributeRequest name="mailNickname" op="Set" value="[GROUP_MAIL_NICKNAME]"/>
    <AttributeRequest name="displayName" op="Set" value="[GROUP_DISPLAY_NAME]"/>
    <AttributeRequest name="groupTypes" op="Set" value="Office365"/>
    <AttributeRequest name="addOwnerAsMember" op="Set">
      <Value>
        <Boolean>true</Boolean>
      </Value>
    </AttributeRequest>
    <AttributeRequest name="owners" op="Add">
      <Value>
        <List>
          <String>[userPrincipalName]</String>
        </List>
      </Value>
    </AttributeRequest>
  </ObjectRequest>
</ProvisioningPlan>

Share all details about your problem, including any error messages you may have received.

Problem:

Teams enablement fails with HTTP 400 error “Team owner not found for group [GROUP_ID]” when submitting a provisioning plan to create an Office 365 group with Teams enabled.

What Happens:

  • Office 365 group creates successfully
  • Owner is assigned successfully (confirmed via aggregation)
  • Teams enablement POST request fails immediately after group creation

Error:

Response Code - 400 
Error - Team owner not found for group [GROUP_ID]

Questions:

  1. The provisioning plan above should work - is there something wrong with how we’re structuring the attributes?

  2. Should we be splitting this into separate provisioning stages instead of a single plan? For example:

    • Stage 1: Create group with owner
    • Stage 2: Enable Teams after delay

  3. Is there a recommended way in IIQ 8.5p2 to handle Azure AD replication delays between group creation and Teams enablement?

  4. Should the workflow include a wait step between group provisioning and Teams enablement, or should this be handled at the connector level?

  5. Is there a best practice for staging Office 365 group creation with Teams enablement to avoid this timing issue?

Additional Context:

  • Owner account has valid Teams license
  • Azure connector has required Graph API permissions
  • Issue occurs intermittently across all group creation attempts
2

You need to try doing this in 2 steps. Create the group without setting teamsEnabled attribute to true and then update this attribute after sometime.
What workflow or process do you use for Azure group creation?

3

Did some more digging, and yes you appear to be correct. Another developer had this same issue and reported success after doing it in two steps. Now, I just have to do the grunt work to update the plans and pass in the objectID and such to do CREATE then MODIFY the group.

We have a custom workflow that is an API call for ServiceNow to provision teams channels for people. I’ve narrowed the problem scope to just re-adjusting the provisioning plan into two, and I should be able to knock it out.

https://developer.sailpoint.com/discuss/t/error-in-provisioning-entra-id-group/205348/4