Help me understand the Role of Timeout Settings in Resolving Duplicate AD Account Creation Issue

[sunnyajmera]

I’ve been trying to fix an issue where duplicate AD accounts are being created for certain identities randomly as described in this post

AD Duplicate Account Creation

Folks, I am seeing duplicate AD accounts being provisioned for several identities—each duplicate appears just seconds after the original. I’ve reviewed the configuration and can’t find a cause. Any ideas on what might be triggering this? Here is one example: [image] As you can see, there is a gap of only 8 seconds between these two activities. [image (1)] [image (2)] [image (3)] [image] On the identity, here are the events [image]

After several weeks of internal investigation and working with SailPoint support, the recommended fix—based on similar reports from others—appears to be increasing the provisioningTimeout and IQServiceResponseTimeout values.

While I understand how increasing timeouts might help in some scenarios, I’m struggling to see how they directly relate to this specific issue. In many cases, the duplicate AD account is created just seconds after the first, so it’s unclear how simply increasing these timeout values would prevent that.

Of course, I want to resolve the issue, but I also want to fully understand the reasoning behind this recommendation—both to validate the fix and for my own clarity.

For those who have implemented this fix, could you please help me understand the reasoning behind it?