Azure AD Connect dn-attributes-failure Sync Error

Question

I'm getting dn-attributes-failure sync errors for AD security groups in Azure AD Connect. From what I could find the two likely causes are disabled AD users being members of the on-prem group and two on-prem AD groups having duplicate attributes. I've removed all disabled AD users from the affected AD groups and done an initial resync though, and that did not resolve the issue, and it looks like none of the groups have any identical properties, so that's not the issue.

Has anyone else had a similar issue?

Answer 1

Hello @KRW Admin

Thank you for reaching out. The error Dn-Attribute-failure on AD Security Groups usually occurs when there are users with duplicate attribute values in the on-premises domain and are part of the group being sync'd to Azure AD. For example, you can have the same SMTP/Proxy address configured for 2 users in local AD, but when you sync those users to Azure AD, you will encounter a Dn-Attribute-failure error for all the AD Security Group user is part of.

To resolve this error, you need to correct the duplicate attributes in your on-premises AD all the users who are part of the affected group. After making the changes in your local AD, run Start-ADSyncSyncCycle -PolicyType Initial to run a full sync cycle.

Read more: End-to-end troubleshooting of Azure AD Connect objects and attributes

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Good morning!

@Harpreet Singh Matharoo
How do I resolve this error? I have already resolved the user errors, now it appears in the groups.

https://learn.microsoft.com/pt-br/entra/identity/hybrid/connect/tshoot-connect-sync-errors