Production AZURE AD aggregation delay

IdentityIQ (IIQ) IIQ Discussion and Questions
, , ,
1

Hi

In our Production, the Account Aggregation for the source "Azure AD " has been running normally, typically completing within 1.5 hours.

The Entitlement Aggregation for the same source is also completing successfully and has not experienced any issues.

This issue relates specifically to the Account Aggregation issue.

Observations from Aggregation History

  • 7 September 2026, 10:00:02 – The Account Aggregation encountered the following error:

    Error occurred while processing aggregation :: Failed to perform delta aggregation sailpoint.connector.ConnectorException: Error occurred in delta aggregation sailpoint.connector.ConnectorException: Exception occurred in processReadRequest. Error - Response Code - 400 Error - 400 Badly formed token

  • The aggregation subsequently recovered automatically and completed/recovered around 7 September 2026, 11:00:03.

  • 8 September 2026, 08:00:05 – The same “400 Badly formed token” error was observed again.

  • 8 September 2026, 14:00:02 – The Account Aggregation had been running for more than 18 hours, which is significantly outside the normal runtime. As this did not appear normal, I cancelled the aggregation. The remaining scheduled aggregations were also did not run as above was still running.

Configuration Changes

There were no configuration changes made prior to the aggregation delay observed on 8 September.

As a side note, I have also enabled Account Deletion with a threshold of 40%. However, this configuration change was not made when the issue initially started and therefore does not appear to correlate with the start of the problem.

Current Status

A new Account Aggregation was started today from a fresh run. It has now been running for more than three hours, whereas historically the aggregation has normally completed within this timeframe.

In particular, it would be helpful to understand:

  • Why the aggregation, which has historically completed in less than one hour, is now taking significantly longer considering no source changes with respect to accounts as well.

  • Whether there are any known issues with the connector, source, or backend service that could explain this behaviour.

The Account and Entitlement Aggregations for this source had been operating normally prior to this issue, so we would appreciate assistance in identifying what has changed or what may be causing the current degradation and any steps to troubleshoot or fix. Also checked the VA cluster and memory and CPU all normal.

Regards

2

Hi @lalithajay - Delta’s can be finnicky with Azure. Sounds like the DeltaLink used by Graph may have been corrupted on the Azure side leading to the errors you got.
When you created a new aggregation task it will do a Full Aggregation in order to be able to generate the delta’s next time.

Once it finishes, let us know if you see a significant improvement in run time for the delta or if there are still issues.

3

Hi @ryan_toornburg thanks for your answers, by looks, the token got some issue and Azure rejected and that kick off a Full Aggregation

we also have Azure AD account creation event triggers configured, which can trigger emails and other downstream business functionality for end users. Therefore, a prolonged aggregation has the potential to impact these business processes.

Do you have any recommendations/configurations or optimisations that we could make to our current setup to:

  • Avoid or reduce the likelihood of these token-related issues occurring.

  • Prevent a token issue from resulting in a full aggregation that could potentially run for more than 18 hours.

  • Improve the recovery process so that, if a token issue does occur, the aggregation can recover within a reasonable timeframe.

My main concern is that if a token issue can cause the aggregation to fall back to a full aggregation, and that aggregation can subsequently take 18+ hours, it could have a significant impact on our downstream business functionality.

Secondly, I cannot see any percentage progress or other indication of how far the aggregation has progressed. Is there any way to determine whether the aggregation is progressing normally, for example, the number of accounts processed or an estimated remaining time? At the moment, it is difficult to determine whether the aggregation is actively progressing or effectively stalled.

Currently, the latest aggregation has been running for more than 6 hours and is still showing 0% / Pending.

Any guidance on both the token issue/recovery and how we can better monitor aggregation progress would be greatly appreciated.