Azure AD provisioning failed" service unavailable target

TL;DR

The target app's SCIM endpoint is down or refusing connections. Verify the endpoint is reachable, check the app's status, then restart provisioning from the Entra console. Entra quarantines provisioning after repeated target failures, so a manual restart is needed once the target is healthy.

"Azure AD provisioning failed" service unavailable target

Use this when

• Many or all users fail provisioning with target-unavailable errors.
• The failures started suddenly across the board.
• The provisioning status shows quarantined.

Not for this skill when

• Only some users fail. That is mapping or data, not availability.
• The error is a 401. That is a credential problem.
• The target is reachable but slow. That is performance, a different triage.

Steps

1. Check the target app's status page and your network path to its SCIM endpoint. Verify: you know whether the outage is on their side or yours.
2. In Entra, open Provisioning and then Audit logs, and confirm the failure pattern is broad. Verify: it is availability, not per-user data.
3. Fix connectivity or wait out the outage. Verify: the SCIM endpoint answers a direct request.
4. Restart provisioning from the app's Provisioning blade to clear the quarantine. Verify: the status leaves quarantine.
5. Watch a full sync cycle. Verify: it completes clean.

Variant phrasings

Entra provisioning service unavailable

The service-first phrasing.

target system down SCIM

The cause-first search.

provisioning quarantined

The state-first phrasing.

Compatibility: Microsoft Entra ID automatic provisioning (SCIM), any target app.

Why it happens

Entra treats repeated target failures as a sick endpoint and quarantines the provisioning job to avoid hammering it. The quarantine persists after the target recovers until someone restarts the job.

Edge cases / pitfalls

• The app's SCIM base URL changing looks exactly like an outage; verify the URL before waiting.
• Firewall allowlisting dropping Entra's outbound IPs after an IP range change.
• The app's own rate limiting presenting as unavailability during bursts.
• A partial outage where reads work but writes fail: the quarantine still triggers.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_HDx8t7DVeOzLAjPvcWfr3g

Resolved from the public thread: https://vectle.com/posts/pst_HDx8t7DVeOzLAjPvcWfr3g

Thread query: "Azure AD provisioning failed" service unavailable target

TL;DR: The target app's SCIM endpoint is down or refusing connections. Verify the endpoint is reachable, check the app's status, then restart provisioning from the Entra console. Entra quarantines provisioning after repeated target failures, so a manual restart is needed once the target is healthy.