Entra ID provisioning logs show quarantined job: sync failed error troubleshooting

TL;DR

Find and fix the repeated failure that tripped the quarantine threshold before restarting, or the job will quarantine again. Review the quarantine email and provisioning logs to identify the dominant error, repair that cause for the affected users, restart provisioning, and watch the next cycles closely until the success rate stays healthy.

Entra ID provisioning logs show quarantined job: sync failed

Use this when

• The app Provisioning page shows a quarantined status and the sync has stopped making changes.
• A quarantine notification arrived naming repeated failures in the job.
• Provisioning logs show the same error for many users over several cycles.

Not for this skill when

• The job was paused or placed in quarantine manually for a change freeze. Follow the freeze plan instead.
• Only one user fails occasionally while the job stays healthy. Fix that user record without a restart.

Steps

1. Open the enterprise app Provisioning page and read the quarantine banner and current status details, noting when quarantine started and the failure summary Microsoft recorded. Save the quarantine notification details for the incident record. Verify: the quarantine start time and stated reason are documented
2. In Provisioning logs, filter failures since before the quarantine start and group them by error code and message to find the dominant cause, ignoring rare unrelated failures. Pick the top cause and a sample of its affected users as the repair set. Verify: one dominant error accounts for most failures in the window
3. Repair the dominant cause at its root: correct the mapping, target permissions, credential, or source records involved, using the step detail of a sample failure as the specification for the fix. Do not restart the job yet, because restarting against the same cause re-trips the threshold quickly. Verify: the fix is saved and a sample failure record is corrected
4. Use Provision on demand for several sample users from the repair set and confirm each completes successfully through all steps. If any still fail, return to the logs and treat the new detail as the next cause before proceeding. Verify: all sampled users provision successfully on demand
5. Restart provisioning from the Provisioning page to clear quarantine, then monitor the job status and logs through the next full cycles, watching the success percentage recover. Keep the sample users in the watch list for regressions. Verify: the job leaves quarantine and completes a full cycle with a healthy success rate
6. Reduce recurrence by adding an alert on rising provisioning failure counts for this app and by reviewing the top errors weekly, so the next drift is caught long before the quarantine threshold. Verify: the alert rule exists and a test failure notification reaches the team channel

Why it happens

Entra quarantines a job when failures exceed a threshold over a sustained window, protecting target systems from a flood of bad operations. The trigger is almost always a systematic cause such as an expired credential, a mapping change, or a target schema change that makes most operations fail the same way. Restarting without repair simply repeats those failures and the job quarantines again, sometimes with a longer backoff. Fixing the dominant cause first and proving it on demand makes the restart durable.

Variants and edge cases

Quarantine after credential expiry

Rotate the target credential or secret in the app provisioning settings, run the test connection, then restart. Credentials are the most common single cause of sudden mass failure.

Quarantine after a target app update

Vendor updates can rename schema attributes. Compare the app schema in Entra with the vendor current schema and remap any renamed attributes before restarting.

Job quarantines repeatedly every few weeks

A recurring cycle points to a data feed that periodically sends bad values, such as a monthly HR file. Add source validation for the offending attribute instead of repeatedly repairing the job.

Compatibility: Applies to Microsoft Entra ID automatic provisioning jobs for SaaS and SCIM apps that support quarantine and restart. Requires Application Administrator rights.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstTLnD7NtoLXa0iY8aNT11g