Account syncing Issue

Question

We are using a hybrid environment, where disabling an account in the local Active Directory also disables it in Azure AD. However, I disabled one specific account in Active Directory, and it has not been disabled in Azure AD. When I disable it in Azure AD, it gets re-enabled after 30 minutes. This issue is happening with only one account.

Answer 1

Hi faraz imran,

Thank you for posting in the Microsoft Community Forums.

1. Check Account Synchronization Settings

First, ensure that your Azure AD Connect is configured correctly so that changes in Active Directory are properly synchronized to Azure AD. check the following settings:

Sync rules: see if there are custom sync rules for this specific account that may override the default disabled behavior.

Connection filters: verify that no filters prevent synchronization for this account.

Attribute Mapping: Check the attribute mapping settings to make sure that the account status (e.g. enabled/disabled) is mapped correctly.

2. Troubleshooting automatic re-enablement issues

You can consider the following troubleshooting steps for this account being automatically re-enabled in Azure AD:

Conditional Access Policies: check if there are any conditional access policies or automation scripts that may automatically re-enable the account after detecting that it has been disabled.

Azure AD automation: check for automation tasks in Azure AD, such as Azure Automation Runbooks or Azure Logic Apps, that may trigger the re-enabling of the account.

Third-party tools: If you use third-party identity management or synchronization tools, check whether these tools may interfere with the account status.

3. Check account status and history

Azure AD Portal: Check the status and history of the account in the Azure AD Portal for any unusual actions or events.

Audit Logs: Check the audit logs for Azure AD to get detailed information about changes to the account status.

Best regards

Neuvi