Azure AD Connect service critical alert reported: dn-attributes-failure

Question

[I sent an email to askaadconnecthealth@microsoft.com with the below content a few days ago but haven't heard back so decided to start a conversation here]&nbsp;As per the below synchronization errors email I have been receiving, there are three cloud-only Office 365 users with “Sign in ‎blocked” that were previously synched using Azure AD Connect.&nbsp; The accounts were previously moved out of the sync OU and when they appeared as deleted users in Office 365, were restored to keep their data intact.&nbsp; The AD users have since been deleted and cannot be restored.&nbsp;https://aad.portal.azure.com/#blade/Microsoft_Azure_ADHybridHealth/AadHealthMenuBlade/SyncErros&nbsp;There are no further error details other than the type: dn-attributes-failure&nbsp;There are no other sync errors and Azure AD Connect is showing success on all connector operations.&nbsp;I do not want to delete these accounts from Office 365.&nbsp;Could anyone please advise me to know which steps to take to resolve the issue causing these three accounts to be included in the report for synchronization errors?&nbsp; They are cloud-only and do not need to be synched with AD.&nbsp;Is it necessary to re-create the AD users in the sync OU and set their Office 365 account ImmutableID to sync and match their AD account (source anchor is objectGUID) so they do not get reported as sync errors?&nbsp;-----&nbsp;From: Microsoft Azure [mailto:azure-noreply@microsoft.com]Sent: 02 September 2019 11:10Subject: We detected synchronization errors in your directory&nbsp;&nbsp;There are synchronization errors in your directory.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Azure AD Connect Sync errors detectedYou’re receiving this email because we have detected a critical alert on your Azure AD Connect service for errors that occurred while data was while synchronizing between your on- premises active directory and your Azure Active Directory.&nbsp;&nbsp;Title:Sync errors detected on your Azure AD Connect service&nbsp;Last export time:August 13, 2019 15:25 UTC&nbsp;Error count:3 sync errors&nbsp;Service:[tenant].onmicrosoft.com&nbsp;Tenant:John Hanson School&nbsp;Report:To get more details, see Sync Error Report.&nbsp;To learn how to fix sync errors, see troubleshooting sync errors.If you have any feedback, please post it to the Azure Active Directory Feedback Forums or contact us for any questions.&nbsp;&nbsp;&nbsp;Privacy StatementMicrosoft Corporation, One Microsoft Way, ​Redmond, WA 98052​&nbsp;&nbsp;&nbsp;

randy_robb · Answer

rs_oakfordLooks like may be stuck in Azure AD Connect, and is still provisioning when it shouldn't be. Maybe try "set-msoluser -UserPrincipalName &lt;name&gt; -ImmutableID "$null" " ?&nbsp;&nbsp;

Forum Discussion

Azure AD Connect service critical alert reported: dn-attributes-failure

Azure AD Connect Sync errors detected

Share

Resources