Share via

Azure AD Connect not updating user accounts

Daniel Kaliel 1,346 Reputation points
2023-06-16T21:51:01.46+00:00

When I look at the Synchronization Service for Azure AD connect, the Delta Synchronization for every user has the following:

sync-generic-failure

And under the trace I see this:

GetAttribute(): Attribute extension_60f493c9d09642b0a0675e36d2f88e70_thumbnailPhoto not found in schema with GUID: 00000000-0000-0000-0000-000000000000

Windows for business Windows Client for IT Pros Directory services Active Directory
Microsoft Security Microsoft Entra Microsoft Entra ID
0 comments
Accepted answer
  1. Akshay-MSFT 17,951 Reputation points Microsoft Employee Moderator
    2023-06-20T08:44:24.8066667+00:00

    @Daniel Kaliel

    Thank you for posting your query on Microsoft Q&A, from above description we could conclude that you are getting error for an extension attribute (thubnailphoto) while syncing from on-prem to AAD via AAD connect.

    Please do correct me if this is not the case by responding in comments section.

    I found a similar issue Azure Sync Issue With Thumbnails as per which you must try the following:

    Usually, this happens when someone configured an thumbnailPhoto attribute to flow by creating new extension from "Directory extensions" wizard from Azure AD connect as shown below, you can re-run the wizard by going to "customize synchronization options" to confirm if thumbnailPhoto attribute present there? if so then try removing them.

    Moreover, just removing them from wizard doesn't clear pending export error from Azure AD connect local database, so I would recommend you to create custom sync rule which clear pending error from local database, then you can delete this custom sync rule once all pending errors cleanup.

    104146-image.png

    Resolution:

    1. Re-run the wizard by going to "customize synchronization options" and remove thumbnailPhoto attribute
    2. Then, go to Sync rules editor and configure the following outbound rule exactly as in the pictures below:

    104130-image.png

    104267-image.png

    104149-image.png

    1. Run an initial sync through powershell Start-ADSyncSyncCycle -PolicyType Initial

    Once all export errors cleaned up then delete above custom rule which is no longer required.

    Please do let me know if you have any queries.

    Thanks,

    Akshay Kaushik

    Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.