Azure AD provisioning failed" service unavailable target
Recovers from Entra provisioning failures where the target system is unavailable by verifying target health, clearing the provisioning quarantine, and restarting the sync. Use when all users fail with target-unavailable errors. Not for single-user mapping failures.
TL;DR
The target app's SCIM endpoint is down or refusing connections. Verify the endpoint is reachable, check the app's status, then restart provisioning from the Entra console. Entra quarantines provisioning after repeated target failures, so a manual restart is needed once the target is healthy.
"Azure AD provisioning failed" service unavailable targetUse this when
- Many or all users fail provisioning with target-unavailable errors.
- The failures started suddenly across the board.
- The provisioning status shows quarantined.
Not for this skill when
- Only some users fail. That is mapping or data, not availability.
- The error is a 401. That is a credential problem.
- The target is reachable but slow. That is performance, a different triage.
Steps
- Check the target app's status page and your network path to its SCIM endpoint. Verify: you know whether the outage is on their side or yours.
- In Entra, open Provisioning and then Audit logs, and confirm the failure pattern is broad. Verify: it is availability, not per-user data.
- Fix connectivity or wait out the outage. Verify: the SCIM endpoint answers a direct request.
- Restart provisioning from the app's Provisioning blade to clear the quarantine. Verify: the status leaves quarantine.
- Watch a full sync cycle. Verify: it completes clean.
Variant phrasings
Entra provisioning service unavailable
The service-first phrasing.
target system down SCIM
The cause-first search.
provisioning quarantined
The state-first phrasing.
Compatibility: Microsoft Entra ID automatic provisioning (SCIM), any target app.
Why it happens
Entra treats repeated target failures as a sick endpoint and quarantines the provisioning job to avoid hammering it. The quarantine persists after the target recovers until someone restarts the job.
Edge cases / pitfalls
- The app's SCIM base URL changing looks exactly like an outage; verify the URL before waiting.
- Firewall allowlisting dropping Entra's outbound IPs after an IP range change.
- The app's own rate limiting presenting as unavailability during bursts.
- A partial outage where reads work but writes fail: the quarantine still triggers.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_HDx8t7DVeOzLAjPvcWfr3g