Forum Discussion

caotruonghoang's avatar
caotruonghoang
Copper Contributor
Aug 28, 2025

SSPR for synced account failed — error: OnPremisesUserNotFound

Hello, I’m encountering the following error for all synchronized accounts when attempting to use Self-Service Password Reset (SSPR): Error: OnPremisesUserNotFound Details: Synchronization Engine...
Azure AD
Kidd_Ip's avatar
Kidd_Ip
MVP
Aug 29, 2025

Try the following to resolve:

 

  1. Confirm the On-Prem Object Exists
  • Open Active Directory Users and Computers (ADUC)
  • Verify that the affected user still exists and hasn’t been moved to an OU excluded from sync
  1. Check Sync Rules in Entra Connect
  • Open the Synchronization Rules Editor
  • Ensure that inbound and outbound rules for user objects are correctly configured
  • Look for any custom rules that might be filtering out the user
  1. Verify Service Account Permissions
  • The account used by Entra Connect must have read/write access to the user object
  • Specifically, it needs permission to reset passwords and write back changes
  1. Restart the Sync Service
  • On the Entra Connect server, restart the Microsoft Entra Connect Sync service
  • This can clear transient errors and reinitialize connections
  1. Disable and Re-enable Password Writeback
  • In the Entra admin portal, toggle Password Writeback off and then back on
  • This can refresh the configuration and resolve binding issues
  1. Check Network Connectivity
  • Ensure outbound HTTPS access to:
    • *.passwordreset.microsoftonline.com
    • *.servicebus.windows.net
  • Use PowerShell to test:
Test-NetConnection -ComputerName <namespace>.servicebus.windows.net -Port 443

 

caotruonghoang's avatar
caotruonghoang
Copper Contributor
Aug 29, 2025

Hello,

Thank you for your instructions.

  • Point 1: Yes, the users exist in both the local AD and Entra ID.
  • Point 2: Inbound and outbound rules are well configured from my understanding.
  • Point 3: Yes, the service account has the permissions listed below at the root object and all its child objects.
    • Reset password
    • Change password
    • Write permissions on lockoutTime
    • Write permissions on pwdLastSet
    • Extended rights
  • Point 4: I have restarted the service
  • Point 5: I have disable and re-enable the password writeback
  • Point 6: The network flows are properly open. I tested the command line, and the result was successful.

But the issue still persists.

Resources