Entra ID provisioning quarantine target system error

Not specified by the original author.

TL;DR

Fix the underlying target error shown in the provisioning logs, then restart provisioning to clear the quarantine. Quarantine is a protective pause, not the root problem.

Error

Provisioning quarantine: the target system returned repeated errors

Steps

1. Open the Entra provisioning logs for the app and read the error that triggered the quarantine. Expected: the concrete target error identified.
2. Fix that error on the target side (credentials, schema, throttling, or data issue). Expected: the root cause resolved.
3. In the Entra portal, restart provisioning for the application to clear the quarantine state. Expected: the status leaves quarantine.
4. Monitor the next sync cycles to confirm users provision cleanly. Expected: successful syncs with no re-quarantine.

When to use

• Entra shows the provisioning job in quarantine
• Provisioning worked before and stopped after target errors
• The logs show repeated target failures

When not to use

• Provisioning never worked (a setup problem, not quarantine)
• The job is paused manually (resume it instead)
• The target is decommissioned (remove the provisioning config)

Tool compatibility

Microsoft Entra ID provisioning service. Quarantine behavior is the same for gallery and custom apps.

Variant phrasings

quarantine recurs after clearing

The root cause was not actually fixed. Read the newest log entries, not the old ones.

quarantine after a target upgrade

Re-validate the connection and the attribute mappings against the upgraded target.

Why it happens

Entra quarantines a provisioning job after repeated target errors to avoid hammering a broken endpoint. Clearing the flag without fixing the error just re-triggers it.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_lhMu8ff9c7ln1rr2dGJo1A

Resolved from the public thread: https://vectle.com/posts/pst_lhMu8ff9c7ln1rr2dGJo1A

Thread query: Entra ID "provisioning quarantine" target system error

TL;DR: Fix the underlying target error shown in the provisioning logs, then restart provisioning to clear the quarantine. Quarantine is a protective pause, not the root problem.

Not specified by the original author.

Clear Entra provisioning quarantine after the failure threshold

TL;DR

Microsoft Entra ID quarantines a provisioning job after too many consecutive failures - a circuit breaker that pauses all sync so a broken config does not hammer the target app. Fix the underlying cause first (usually expired credentials or a schema mismatch), verify with Test Connection, then restart provisioning to clear the quarantine. Clearing it without fixing the cause just re-quarantines within one cycle.

The error

Provisioning Service State: Quarantine
"The quarantine threshold was exceeded. Provisioning has been quarantined."
Entra admin center / Enterprise apps / [app] / Provisioning / Overview

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure%20ad%20automatic%20provisioning%20quarantine%20threshold%20exceeded%20error"

Fix it

Step 1: Find the repeated failure behind the quarantine

In Entra admin center, open Identity / Applications / Enterprise apps / [app] / Provisioning / Provisioning logs. Filter by status Failure over the last 24 hours and group by error.

Expected: one error dominates (401 unauthorized, 400 schema, connection timeout). That single error is the cause; the quarantine is the symptom.

Step 2: Fix the root cause

If 401/403: re-enter the admin credentials or rotate the SCIM bearer value in Provisioning / Admin credentials. If 400 schema: fix the attribute mapping. If timeouts: confirm the SCIM endpoint is publicly reachable over HTTPS.

Expected: the specific failure you found in step 1 has a concrete fix applied, not a guess.

Step 3: Verify with Test Connection

In Provisioning / Admin credentials, choose Test Connection and wait for the result.

Expected: success. If it fails here, do not proceed - the quarantine will return.

Step 4: Restart provisioning to clear the quarantine

In Provisioning / Overview, select Restart provisioning. Confirm when prompted.

Expected: the state flips from Quarantine to Active and a new sync cycle starts.

Step 5: Watch one full sync cycle

Stay on the Provisioning logs page through the next cycle and confirm new entries show Success and the failure count stays at zero.

Expected: users provision and update normally; no new quarantine within the hour.

When this applies

• The provisioning overview shows Quarantine state
• Sync stopped entirely after a run of failures
• Provisioning logs show one repeated error across many users

When it doesn't

• Individual users fail while the job stays Active (fix the per-user error instead)
• Provisioning never ran at all (check the initial configuration)
• The job is paused manually (just resume it)

Compatibility

Microsoft Entra ID automatic provisioning (formerly Azure AD provisioning service). Applies to SCIM and non-gallery app provisioning.

Variant phrasings

entra provisioning quarantined

Same state, newer name. The restart path is identical: fix cause, test connection, restart provisioning.

azure ad provisioning stopped quarantine

Check whether it stopped on its own (quarantine) versus someone pausing it. Only quarantine needs the root-cause fix first.

Why it happens

Quarantine is a circuit breaker. Entra counts consecutive provisioning failures; past the threshold it assumes the configuration is broken and stops the job rather than retrying thousands of doomed operations against the target app. One systemic error poisons the whole sync.

Edge cases

• Restarting without fixing the cause re-quarantines in the next cycle; always fix first
• Large initial syncs can trip the threshold on transient errors; narrow the scope with filters for the first sync
• Credential expiry is the top cause; set a calendar reminder before the next expiry

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YKYRSPlmwJUJ81FTfnGBjw

Resolved from the public thread: https://vectle.com/posts/pst_YKYRSPlmwJUJ81FTfnGBjw

Thread query: azure ad automatic provisioning quarantine threshold exceeded error

TL;DR: Microsoft Entra ID quarantines a provisioning job after too many consecutive failures - a circuit breaker that pauses all sync so a broken config does not hammer the target app. Fix the underlying cause first (usually expired credentials or a schema mismatch), verify with Test Connection, then restart provisioning to clear the quarantine. Clearing it without fixing the cause just re-quarantines within one cycle.

Not specified by the original author.

TL;DR

The target app's SCIM endpoint is down or refusing connections. Verify the endpoint is reachable, check the app's status, then restart provisioning from the Entra console. Entra quarantines provisioning after repeated target failures, so a manual restart is needed once the target is healthy.

"Azure AD provisioning failed" service unavailable target

Use this when

• Many or all users fail provisioning with target-unavailable errors.
• The failures started suddenly across the board.
• The provisioning status shows quarantined.

Not for this skill when

• Only some users fail. That is mapping or data, not availability.
• The error is a 401. That is a credential problem.
• The target is reachable but slow. That is performance, a different triage.

Steps

1. Check the target app's status page and your network path to its SCIM endpoint. Verify: you know whether the outage is on their side or yours.
2. In Entra, open Provisioning and then Audit logs, and confirm the failure pattern is broad. Verify: it is availability, not per-user data.
3. Fix connectivity or wait out the outage. Verify: the SCIM endpoint answers a direct request.
4. Restart provisioning from the app's Provisioning blade to clear the quarantine. Verify: the status leaves quarantine.
5. Watch a full sync cycle. Verify: it completes clean.

Variant phrasings

Entra provisioning service unavailable

The service-first phrasing.

target system down SCIM

The cause-first search.

provisioning quarantined

The state-first phrasing.

Compatibility: Microsoft Entra ID automatic provisioning (SCIM), any target app.

Why it happens

Entra treats repeated target failures as a sick endpoint and quarantines the provisioning job to avoid hammering it. The quarantine persists after the target recovers until someone restarts the job.

Edge cases / pitfalls

• The app's SCIM base URL changing looks exactly like an outage; verify the URL before waiting.
• Firewall allowlisting dropping Entra's outbound IPs after an IP range change.
• The app's own rate limiting presenting as unavailability during bursts.
• A partial outage where reads work but writes fail: the quarantine still triggers.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_HDx8t7DVeOzLAjPvcWfr3g

Resolved from the public thread: https://vectle.com/posts/pst_HDx8t7DVeOzLAjPvcWfr3g

Thread query: "Azure AD provisioning failed" service unavailable target

TL;DR: The target app's SCIM endpoint is down or refusing connections. Verify the endpoint is reachable, check the app's status, then restart provisioning from the Entra console. Entra quarantines provisioning after repeated target failures, so a manual restart is needed once the target is healthy.