Constraint violation occurred During modify Account

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hey Everyone,

We are seeing issue with some accounts when the modifications happened on Active Directory. Below is the error

{“org”: “CTS”, “pod”: “prd01-useast1”, “created”: “2025-08-21T01:13:42.988Z”, “id”: “ed345e33e3fe1951a7a5842b1b69d43cd2b2b7d7caa263ddce87cb7c96d20501”, “action”: “ModifyAccountFailure”, “type”: “PROVISIONING”, “actor”: {“name”: “System”}, “target”: {“name”: “EGK5525”}, “stack”: “wps”, “trackingNumber”: “c6e9226b274049bb9ff0a0fe716bbae0”, “attributes”: {“cloudAppName”: “Active Directory - CTS”, “provisioningResult”: “failed”, “appId”: “748ca2433e52400e9c89d3be1f9f154f”, “accountUuid”: “null”, “operation”: “Set”, “previousValue”: “null”, “errors”: “[“Error(s) reported back from the IQService - Failed to update attributes for identity CN\u003dEGK5525_RM,OU\u003dServiceAccounts,OU\u003dAzure,DC\u003dhumad,DC\u003dcom. A constraint violation occurred.\n”]”, “sourceName”: “Active Directory - CTS”, “accountName”: “CN=EGK5525_RM,OU=ServiceAccounts,OU=Azure,DC=CTS,DC=com”, “interface”: “Attribute Sync”, “attributeName”: “mail”, “attributeValue”: “[email protected]”}, “objects”: [“ACCOUNT”], “operation”: “MODIFY”, “status”: “FAILED”, “technicalName”: “ACCOUNT_MODIFY_FAILED”, “name”: “Modify Account Failed”, “synced”: “2025-08-21T01:13:45.014Z”, “_type”: “event”, “_version”: “v2”}

Seeing this issue for few users .

Thanks in advance

2

Hi @saikumarS You appear to be attempting to update the mail attribute with a value that already exists in AD: [email protected]

3

Hi @j_place ,

Thanks for the reply.

This user Manager field is empty in AD.

4

Not sure I understand, you’re attempting to update the mail attribute?

5

Yes, trying to update the Email, However user don’t have email address in AD

In what cases we see this error ?

6

You are attempting to add or update the mail attribute with a value that is already used by another user in AD. The mail attribute needs to be unique across the forest.

7

Thinking about it, and if i remember correctly, the mail attribute doesn’t actually need to be unique. The error may be in another attribute that you are sending, but the error just returns the first attribute which may or may not be causing the constraint violation. Maybe post the attribute map for this user?

9

Things to look at: sAMAccountName is unique and no more than 20 characters, manager value is an existing DN, countryCode is a supported value, mailNickname is unique, userPrincipalName is unique. Not an exhaustive list, just some things that can cause constraint violations

10

By looking at the log, it seems the error occurring during attribute sync. Please share the list of attributes which are enabled attribute sync and it may help to narrow down the issue. Also you can check are there multiple sync events for the same attribute for a same account and verify whether the attributes got updated though you have an error. You need to see whether the issue is due to the updated account is not aggregated into SailPoint hence attribute sync keep trying the update process.

Some common scenarios for this error,

  1. Uniqueness - check is there any account already exists with the unique attributes like sAMAccountName
  2. Exceeding Attribute Limitation - If any of the identity attribute(s) data exceeds max length of account attribute.
  3. Delayed Sync: Account might got updated in AD but the latest data not synced back to SailPoint.

I assume the issue might be due to #2 or #3 since the error is only for few accounts.

11

Hi Suresh ,

Below are the attributes that we enabled for AD.

division
department
givenName
sn
info
TCSCustomWorkday2
stl
postalCode
TCSCustomWorkday01
TCSCustomWorkday05
TCSCustomWorkday07
TCSCustomWorkday08
TCSCustomWorkday09
TCSCustomWorkday10
TCSCustomWorkday11
TCSCustomWorkday12
employeeID
TCSCustomWorkday14
TCSCustomWorkday19
TCSCustomWorkday21
TCSCustomWorkday04
TCSCustomWorkday20
departmentNumber
title
physicalDelivery
OfficeName
street
middleName
extensionAttribute4
employeeType
extensionAttribute3

What will be the solution if sync is delayed ?

And what will be the attribute limitation ?

Thanks for the response.

12

Hi @saikumarS Are you sure that’s all the attributes you are syncing, because mail isn’t in there?

13

We are not syncing Mail Attribute.

14

Hello @saikumarS,

Just check whether for all your mentioned attributes for whom you have enabled the attribute sync, are there any constraints that has been put by AD team?

Means, is there any length limitations, any predefined rules on any attributes etc. Once you find out that

Also, while testing this scenario, is there any OU movement or CN change happening around same thread for the user? If that is the case, then, there might be some delay in it because OU movements or CN changes takes some time for AD connector to reflect into ISC.

Also, Go to ISC tenant –> Identity Management –> Identities. Search for your identity, open your identity –> go to Events and check which are the Modify Account Events specific to AD that has FAILED.

Thank You,

Regards,

Rohit Wekhande.

1 Like
15

Your original error message indicates that mail is being synchronised

16

Yes jeremy , I see that. However, Email sync is not enabled.

And i see that other attributes sync also failng and seeing same error.

Not sure which attribute is causing error .

Checking with AD team on this.

thanks

17

Do you have an Update Policy at all?

18

We don’t have any update policy .

19

As @j_place said, the mail attribute is not in the list and your initial error is on mail attribute. Is it something you enabled attr-sync earlier and disabled now? Does the issue occur now?

Anyway, here is a debugging steps and please do it in SB.

  1. Get the data of all these identity attributes from the erroring identity and one of succeeded identity and compare the length of each identity attribute value.
  2. Enable the attribute sync only for those attributes one by one.
  3. It will error out when the length is exceeding the account attributes limitation. Since you are enabling one attribute sync at a time, you can easily find the attribute.

On your questions,

What will be the solution if sync is delayed ? Mostly it will be taken care by the connector itself. This is an exceptional issue and it occurs due to resource unavailability like if AD is not responding frequently.

what will be the attribute limitation ?

You need to verify the Active Directory documentation for the predefined attributes and check with AD team on custom attributes.

1 Like