entra id automatic provisioning quarantine error

entra id automatic provisioning quarantine error

TL;DR

Quarantine is Entra's circuit breaker, not the real problem: find the root cause in the provisioning logs first (expired admin credentials and broken attribute mappings are the usual suspects). Fix the cause, then go to the app's Provisioning page and choose Restart provisioning to clear quarantine. Watch one full sync cycle complete and set the notification email so the next quarantine pages someone instead of sitting silently.

entra id automatic provisioning quarantine error

Use this when

• The Entra provisioning blade shows status Quarantine for an enterprise app
• Users stopped syncing to the target app days ago with no alert
• Provisioning logs show a sudden wall of failures before the quarantine timestamp

Not for this skill when

• A single user failed to provision but the job is still running (fix the user)
• Provisioning was never set up (configure it first)
• The target app is down for maintenance (wait it out, then restart if quarantined)

Steps

Step 1: Read the provisioning logs

In Entra ID go to Enterprise apps, open the app, then Provisioning logs. Filter by date around the quarantine start and by failure status. Expected: you find the repeating error, e.g. invalid credentials or a mapping failure, that tripped the breaker.

Step 2: Fix the root cause

Re-authenticate the admin credentials if they expired or the password changed. Fix attribute mappings that reference missing source attributes. Confirm the target app's SCIM endpoint is reachable. Expected: the underlying failure is resolved, not just acknowledged.

Step 3: Restart provisioning

On the app's Provisioning overview page, select Restart provisioning. This clears the quarantine state and starts a fresh sync cycle. Expected: status moves from Quarantine back to active syncing.

Step 4: Watch a full cycle

Monitor the provisioning summary and logs through one complete cycle. Confirm users provision, update, and deprovision as expected. Expected: the cycle completes with failures at or near zero.

Step 5: Set the notification email

In the provisioning settings, set the notification email to a monitored distribution list so quarantine and failure alerts reach a human. Expected: a test alert or a confirmed setting that the next failure will notify someone.

Step 6: Document the recurrence guard

Note what caused this quarantine and add a calendar or runbook check for credential expiry. Expected: the same cause cannot silently quarantine the job again.

Tool compatibility

Microsoft Entra ID (Azure AD) automatic provisioning; enterprise apps with SCIM-based provisioning; provisioning logs in the Entra admin center.

Variant phrasings

Variant 1

azure ad provisioning quarantine how to restart

Variant 2

entra id automatic provisioning stuck in quarantine fix

Variant 3

provisioning quarantine threshold exceeded entra id enterprise app

Why it happens

Entra's provisioning service trips quarantine after a sustained run of failures (on the order of thousands, or repeated authentication failures) to stop hammering a broken target. The quarantine state persists even after the target recovers, which is why fixing the credentials or mapping alone never resumes syncing: the breaker must be reset explicitly with Restart provisioning. Common triggers are expired service-account passwords, revoked OAuth grants on the target side, and attribute mappings that start failing when the source directory schema changes. Because the default notification email is often unset, teams usually discover quarantine weeks later from missing users rather than from an alert.

Edge cases / pitfalls

• Restarting without fixing the cause just re-quarantines on the next cycle; always fix first.
• Scoping filters that match zero users can look like a provisioning stall; check the filter before assuming quarantine.
• After restart, the initial cycle can take a while on large directories; do not restart twice in a panic.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_zjUNvFYPyqGtEmLIqbog5w