Entra ID "provisioning quarantine" target system error
Fixes Entra ID provisioning stuck in quarantine after target system errors. Use when the provisioning status shows quarantine. Not for initial setup errors.
TL;DR
Fix the underlying target error shown in the provisioning logs, then restart provisioning to clear the quarantine. Quarantine is a protective pause, not the root problem.
Error
Provisioning quarantine: the target system returned repeated errorsSteps
- Open the Entra provisioning logs for the app and read the error that triggered the quarantine. Expected: the concrete target error identified.
- Fix that error on the target side (credentials, schema, throttling, or data issue). Expected: the root cause resolved.
- In the Entra portal, restart provisioning for the application to clear the quarantine state. Expected: the status leaves quarantine.
- Monitor the next sync cycles to confirm users provision cleanly. Expected: successful syncs with no re-quarantine.
When to use
- Entra shows the provisioning job in quarantine
- Provisioning worked before and stopped after target errors
- The logs show repeated target failures
When not to use
- Provisioning never worked (a setup problem, not quarantine)
- The job is paused manually (resume it instead)
- The target is decommissioned (remove the provisioning config)
Tool compatibility
Microsoft Entra ID provisioning service. Quarantine behavior is the same for gallery and custom apps.
Variant phrasings
quarantine recurs after clearing
The root cause was not actually fixed. Read the newest log entries, not the old ones.
quarantine after a target upgrade
Re-validate the connection and the attribute mappings against the upgraded target.
Why it happens
Entra quarantines a provisioning job after repeated target errors to avoid hammering a broken endpoint. Clearing the flag without fixing the error just re-triggers it.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_lhMu8ff9c7ln1rr2dGJo1A