Error while user provisioning to EntraID

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hello All,
I recently spot an strange case with user provisioning to EntraID with out of the box connector: Cetrain identities are receiving error:
[ConnectorError] Error occurred in create user (requestId: 51e3781daefb4856b31e85d2c080328e)
while others are being provisioned with no issues whatsoever.

Config:
we are creating users with few attributes set in Account Profile: static value, password generator, 1to1 IDP identity attribute mapping and 3x transform that are taking displayFirstName, displayLastName, displayName, firstname and lastname from IDP. Regarding transforms it’s nothing fancy - concats that merge displayName with suffix.

Now, all identites that we would like to provision are having those values in IPD so there is no difference between them.

Question:
How this is possible that some account are created properly and some are getting constatly error? As this is Saas connecter
Screenshot as a link to hosting service (legit one)

Many thanks for help in advance

2

Hi @radoslaw_klimkowski,

Sorry what is the exact error message returned? Can you check the Account Activity in Search?

Regards,

3

Hi @kyle1
As you can see, in Account Activities: all attribures are populated and error isn’t very detailed

Event were empty for that action

4

Can you see a more detailed error message when you call the the Access Request Status API?

5

Can you check if the accounts are not created if it has a common attribute?
Maybe for those accounts, some attributes are violating some policies or value constraint.

check where you are creating it and what resources you allocate

1 Like
6

API status request gave me this:

https://ibb.co/3ybp7h1

7

i do not think that there are policy violation (of cource i will check it anyway) but all value we would like to provision are in same format, only latin characters (no special chars)

9

Sad to see the error didn’t change!

Otherwise you can:

  1. Try debugging with a few loggers on and investigating CCG Logs.
  2. Executing the EntraID API directly from Postman, with the same details of the failing users.
  3. Double check Service Account permissions and licenses.
1 Like
10

will investigate and i’ll let you know at the begining of next week

1 Like
11

Hello everyone,

The problem has been solved (actually two problems)

  1. the account could not be created because it was already in the source system, but with a different display name (so our customer filter component did not work) - a correction in the display name import the account.
    2 The second problem was more complex, as it turned out that one of the accounts could not be created with non-Latin characters in the UPN. A change in the transform fixed the issue.

Many thanks for your support and ideas

12

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.