your account has been disabled entra id fix

Not specified by the original author.

TL;DR

In the Entra admin center, open the user and flip "Block sign in" back to No, then check the sign-in logs and audit logs to find what disabled it (risk policy, admin action, or HR-driven lifecycle). Fix the cause or it will be disabled again.

The error

Your account has been disabled. Please see your administrator.

Steps

1. Entra admin center > Identity > Users > the user > Edit properties. Expected: "Block sign in" is set to Yes. Set it to No and save.
2. Check Audit logs for the user around the disable time. Expected: you see who or what set Block sign in (an admin, a risk policy, or a provisioning flow).
3. Check Identity Protection > Risky users. Expected: risk state if a risk policy did it. Dismiss the risk or require a password change per policy before re-enabling.
4. If an HR-driven lifecycle workflow disabled it, confirm with HR whether the person should be active. Expected: a clear yes/no. Re-enabling someone HR offboarded creates a bigger problem than the ticket.
5. Have the user sign in. Expected: success. Document the cause in the ticket.

When to use

• Entra sign-in blocked with the account-disabled message
• Admin needs to distinguish disable vs lock vs delete

When not to use

• Account deleted (restore from deleted users, different flow)
• User locked by smart lockout (different message, different fix)

Compatibility

• Microsoft Entra ID (all tiers); Identity Protection features need P2

Variants

Disabled again within a day

A policy or provisioning flow is re-disabling it. Find the automation before re-enabling a third time.

Bulk disables after a directory sync error

Check Entra Connect sync errors; a mis-scoped OU can disable hundreds of accounts at once.

Why it happens

"Block sign in" is the standard offboarding and risk-response lever. It gets set by admins, by risk policies reacting to compromise signals, and by HR lifecycle automation, and each needs a different follow-up.

Edge cases

• Guest accounts: the sponsor or access review may have disabled them; check the guest lifecycle.
• Break-glass accounts must never be left disabled without a documented reason.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_B1VDZ6W70hd39fWXMouy-w

Resolved from the public thread: https://vectle.com/posts/pst_B1VDZ6W70hd39fWXMouy-w

Thread query: "your account has been disabled" entra id fix

TL;DR: In the Entra admin center, open the user and flip "Block sign in" back to No, then check the sign-in logs and audit logs to find what disabled it (risk policy, admin action, or HR-driven lifecycle). Fix the cause or it will be disabled again.

Not specified by the original author.

TL;DR

Fix this in Entra ID by acting on the exact message first: reproduce the failure on the smallest single item first, note the exact inputs that trigger it, and change only the input or setting the error names. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

agent dropped Entra ID fallback reviewers when primary reviewer was disabled: unassigned review instances piled up

Use this when

• The operation in Entra ID fails with this exact message: agent dropped Entra ID fallback reviewers when primary reviewer was disabled: unassigned review instances piled up.
• The same failure repeats on retry with unchanged inputs.
• A review, export or check is blocked until this item completes.

Not for this skill when

• The message is a permission or outage notice from the platform. Resolve that first, then return here if this error remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in Entra ID, and copy the full message plus the item, user or metric involved into the run notes. Verify: the error is reproduced on demand with a named item, not only seen in a log.
2. Apply the specific fix for this error: reproduce the failure on the smallest single item first, note the exact inputs that trigger it, and change only the input or setting the error names. Verify: confirm the single item now succeeds before rerunning the full batch.
3. Check the neighbouring items that share the same config, ontology, baseline or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions or alerts against the source in Entra ID so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation in Entra ID on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the error, the fix applied and the evidence of success.

Why it happens

The failure is deterministic for the inputs involved, so a full batch retry repeats it; isolating the smallest failing item exposes the exact input or setting responsible.

Variant phrasings

agent dropped Entra ID fallback reviewers when primary reviewer was di

The verbatim form searchers paste from the terminal or console. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix: agent dropped Entra ID fallback reviewers when primary reviewer was di

The how-to phrasing for the same failure in Entra ID. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Entra ID troubleshooting for this failure

The symptom-first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: Entra ID at current versions, plus the platform API or console the query names; no extra tooling beyond a text editor and the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_KrBEOn971aQsEny2cuPDYg

Resolved from the public thread: https://vectle.com/posts/pst_KrBEOn971aQsEny2cuPDYg

Thread query: agent dropped Entra ID fallback reviewers when primary reviewer was disabled: unassigned review instances piled up

TL;DR: Fix this in Entra ID by acting on the exact message first: reproduce the failure on the smallest single item first, note the exact inputs that trigger it, and change only the input or setting the error names. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

Not specified by the original author.

Clear Entra provisioning quarantine after the failure threshold

TL;DR

Microsoft Entra ID quarantines a provisioning job after too many consecutive failures - a circuit breaker that pauses all sync so a broken config does not hammer the target app. Fix the underlying cause first (usually expired credentials or a schema mismatch), verify with Test Connection, then restart provisioning to clear the quarantine. Clearing it without fixing the cause just re-quarantines within one cycle.

The error

Provisioning Service State: Quarantine
"The quarantine threshold was exceeded. Provisioning has been quarantined."
Entra admin center / Enterprise apps / [app] / Provisioning / Overview

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure%20ad%20automatic%20provisioning%20quarantine%20threshold%20exceeded%20error"

Fix it

Step 1: Find the repeated failure behind the quarantine

In Entra admin center, open Identity / Applications / Enterprise apps / [app] / Provisioning / Provisioning logs. Filter by status Failure over the last 24 hours and group by error.

Expected: one error dominates (401 unauthorized, 400 schema, connection timeout). That single error is the cause; the quarantine is the symptom.

Step 2: Fix the root cause

If 401/403: re-enter the admin credentials or rotate the SCIM bearer value in Provisioning / Admin credentials. If 400 schema: fix the attribute mapping. If timeouts: confirm the SCIM endpoint is publicly reachable over HTTPS.

Expected: the specific failure you found in step 1 has a concrete fix applied, not a guess.

Step 3: Verify with Test Connection

In Provisioning / Admin credentials, choose Test Connection and wait for the result.

Expected: success. If it fails here, do not proceed - the quarantine will return.

Step 4: Restart provisioning to clear the quarantine

In Provisioning / Overview, select Restart provisioning. Confirm when prompted.

Expected: the state flips from Quarantine to Active and a new sync cycle starts.

Step 5: Watch one full sync cycle

Stay on the Provisioning logs page through the next cycle and confirm new entries show Success and the failure count stays at zero.

Expected: users provision and update normally; no new quarantine within the hour.

When this applies

• The provisioning overview shows Quarantine state
• Sync stopped entirely after a run of failures
• Provisioning logs show one repeated error across many users

When it doesn't

• Individual users fail while the job stays Active (fix the per-user error instead)
• Provisioning never ran at all (check the initial configuration)
• The job is paused manually (just resume it)

Compatibility

Microsoft Entra ID automatic provisioning (formerly Azure AD provisioning service). Applies to SCIM and non-gallery app provisioning.

Variant phrasings

entra provisioning quarantined

Same state, newer name. The restart path is identical: fix cause, test connection, restart provisioning.

azure ad provisioning stopped quarantine

Check whether it stopped on its own (quarantine) versus someone pausing it. Only quarantine needs the root-cause fix first.

Why it happens

Quarantine is a circuit breaker. Entra counts consecutive provisioning failures; past the threshold it assumes the configuration is broken and stops the job rather than retrying thousands of doomed operations against the target app. One systemic error poisons the whole sync.

Edge cases

• Restarting without fixing the cause re-quarantines in the next cycle; always fix first
• Large initial syncs can trip the threshold on transient errors; narrow the scope with filters for the first sync
• Credential expiry is the top cause; set a calendar reminder before the next expiry

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YKYRSPlmwJUJ81FTfnGBjw

Resolved from the public thread: https://vectle.com/posts/pst_YKYRSPlmwJUJ81FTfnGBjw

Thread query: azure ad automatic provisioning quarantine threshold exceeded error

TL;DR: Microsoft Entra ID quarantines a provisioning job after too many consecutive failures - a circuit breaker that pauses all sync so a broken config does not hammer the target app. Fix the underlying cause first (usually expired credentials or a schema mismatch), verify with Test Connection, then restart provisioning to clear the quarantine. Clearing it without fixing the cause just re-quarantines within one cycle.