Azure Provisioning Log: Understanding "TargetObjectActionDisabled"

Daniel F 0

Hi there,

I'm trying to find out what following SkipReason means.
TargetObjectActionDisabled

The log entry is as follows:
Result: Skipped

Description: User 'xxx' will be skipped. Skip Reason: The Add operation was not performed because the Add operations are disabled in the provisioning configuration.

SkipReason: TargetObjectActionDisabled

What exactly is the "Add operation"? Does it require Target Object Actions "Update" to be set up in the attribute Mapping in Provision Azure Active Directory Users?

Thanks for you help!

Cheers

Sina Salam 3,901 Reputation points

2024-04-30T13:59:12.5633333+00:00
Hello Daniel F ,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

Problem

Sequel to your question, I understand that you are encountering a skip reason ("TargetObjectActionDisabled") in an Azure provisioning log, indicating that the "Add" operation was not performed due to disabled add operations in the provisioning configuration and you would like clarification on the meaning of this skip reason, an understanding of the "Add operation", and clarification on whether setting up the "Update" action is required for performing the "Add" operation.

Scenario

As an IT administrator at Microsoft Entra ID, you're responsible for managing Azure Active Directory (AAD) user provisioning. While reviewing provisioning logs, you notice entries with the skip reason "TargetObjectActionDisabled". Unsure about its implications, and Daniel is seeking clarification to ensure smooth provisioning operations.

Solution

This prescribed solution was based on the scenario given and your questions, while focusing on the problem statement.

Firstly, based on your question 1.

I'm trying to find out what following SkipReason means. TargetObjectActionDisabled

Skip Reason - "TargetObjectActionDisabled":

This message in your Azure provisioning log means that the system was set to skip the "Add" operation. In other words, it didn't add a new object because adding is turned off in the settings.

Question 2.

What exactly is the "Add operation"?

Answer:

Add operation: It's the action of putting new users or other items into Azure Active Directory.

Question 3.

Does it require Target Object Actions "Update" to be set up in the attribute Mapping in Provision Azure Active Directory Users?

Answer:

No, "Add" works on its own, but you might set up "Update" to make changes to things that are already there.

Finally

If you would like to fix the issue, check your Azure settings to make sure the "Add" function is turned on if you want to add new things. If it's off on purpose, double-check that it fits your security needs. If it's off by mistake, you'll need to switch it on to start adding new objects.

Follow these steps:

Log in to the Azure Portal using your administrator account.

Navigate to Azure Active Directory/ Microsoft Entra ID > Enterprise Applications.

Select the application you're provisioning users to.

Go to the Provisioning tab.

In the Settings section, find the Provisioning Mode and ensure it's set to "Automatic".

Below that, locate the Admin Credentials section or similar, where you can input the necessary credentials for the application you're provisioning to.

Scroll to the Mappings section, where you can define how user attributes are synchronized between Azure AD and the target application.

Ensure that the Attribute Mappings for the "Add" operation are correctly configured and enabled.

If everything is set up correctly but the "Add" operation is still disabled, look for an option to Enable/Disable this specific operation and make sure it's enabled.

After making changes, always Test Connection to ensure that the settings are correct and operational.

Save any changes you've made.

References

Configure Azure AD to Provision Servicenow accounts.

[Configure SCIM provisioning using Microsoft Entra ID]( https://learn.microsoft.com/en-us/azure/databricks/administration-guide/users-groups/scim/aad.

)

Accept Answer

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

** Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful ** so that others in the community facing similar issues can easily find the solution.

Best Regards,

Sina Salam

1 answer

Givary-MSFT 28,571 Reputation points Microsoft Employee

2024-05-01T06:14:08.8466667+00:00

@Daniel F Thank you for reaching out to us, As I understand you looking to get more details on this message "TargetObjectActionDisabled" which appears during provisioning.

TargetObjectActionDisabled - It's not really an error, the provisioning engine trying to look for a matching identity in the target but since it doesn't find one, it tries to create a new one. Since the Add option is disable under attribute mapping section hence, we skip the action.

TargetObjectAction being referred to can be found under the attribute mappings area and controls what actions AAD/Entra ID is allowed to take on the target, ensure create/update is selected.

Refer to this how application provisioning works - https://learn.microsoft.com/en-us/entra/identity/app-provisioning/how-provisioning-works#:~:text=Provisioning%20cycles%3A%20Initial%20and%20incremental

Let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
Please sign in to rate this answer.

1 person found this answer helpful.
Daniel F 0 Reputation points

2024-05-02T12:09:53.71+00:00

Hi There, thanks for your answer.
What does not add for me, is, that the provisioning log says, it finds the corresponding entity. Here is a detailed log:

And here the settings.

How do you explain that?
Thanks again!

Givary-MSFT 28,571 Reputation points Microsoft Employee

2024-05-02T13:17:30.1866667+00:00

@Givary-MSFT Thanks for your response, quite strange if the user already exists in the target. If it does and we're linking it, would appreciate if you can create a support ticket with our team who can investigate this further.

Daniel F 0 Reputation points

2024-05-02T13:57:59.32+00:00

Yes, the user does exist. I'll create a support ticket, thank you.
Sign in to comment