This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(137.6, 72%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECA%3C/text%3E%3C/svg%3E)
Have a group that is used for Cross Tenant Sync. All but about 5 users sync over. The remaining users in the group are skipped due to "SkippedReason - NotInScope". Cannot locate the reason why. Thanks in advance.
Michael
do those users have federated sign in types as “phone”? I have seen that not work phone.png
I had to try and remove it from users and then they synched, I did report this to the product team as well, because the error doesn't give any indication it's that.
this is the issue as I have managed to replicate it. Find the user in Azure AD, check if the federated sign in type is set as phone. If so got to Authentication Methods and delete the phone number that is likely there providing SMS sign in. Save and refresh the user so as to make sure that the federated identity now shows the domain. Retry the provision on demand for the user and as long as all other prereqs are met it should work.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 44%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDH%3C/text%3E%3C/svg%3E)
how did you remove it ?
from memory, I went and removed their phone from MFA and Sign in devices, this put it back to the domain. They have updated this again but it got them synched
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(32, 13%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EB%3C/text%3E%3C/svg%3E)
@Christian Redgewell what kind of implication does removing the phone from MFA and Sign-in devices? I'm planning on doing this to a "large" amount of users.
to be honest, I only did it for 3 users and none of them said anything. I presume they got a notice to say they needed to add their phone back. Maybe try and test it with some friendlies and see how you go before a large rollout?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(217.60000000000002, 78%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAH%3C/text%3E%3C/svg%3E)
The on-demand provisioning is indicating that the user was skipped because they have an alternative security identifier present on the user. There are two common scenarios where this happens 1) the user is a B2B user in the home tenant and therefore cannot be synchronized 2) The user is an internal user, but SMS sign-in was enabled on the user. It would need to be disabled for sync to work.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(73.60000000000001, 54%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EOT%3C/text%3E%3C/svg%3E)
Disabling SMS MFA for the use fix the issue with the provisioning process.
Hi there,
Can you provision on demand per: https://learn.microsoft.com/en-us/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-configure#step-11-test-provision-on-demand
That should tell you why it was skipped
Here is a screen shot. The user is active so I am not sure why this account will not sync and is skipped.
Can you tell from this screen shot what the issue is? User is active.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 31%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Did you have any luck figuring out why these 5 users did not sync? I have the same issue.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 86%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJG%3C/text%3E%3C/svg%3E)
Seems that if have anything other than none in alternatesecurityID the user is skipped, can that filter be changed? In my case seem because I use my phone a security key. Yes can clear or stop using but why is that necessary?
This check is in place to prevent the service from synchronizing external users. However, users with SMS sign-in are also blocked by the check. This the workaround. https://learn.microsoft.com/en-us/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure#symptom---users-are-skipped-because-sms-sign-in-is-enabled-on-the-user
We plan to support synchronizing users with an alternativeSecurityID, but do not have an ETA for support. We will post in the Microsoft Entra what's new when that is possible.