Recommendation, when facing User Provisioning Error from Microsoft Entra ID to Salesforce:
I recently faced an issue with the user provisioning integration from Microsoft Entra ID to Salesforce. The error response is seen at the bottom (all included for enabling searching of this by others).
Issue Origin:
The issue was caused by a duplicate user being created:
- Proper 'User Real' already existed, without FederationIdentifier
- Then the user provisioning system synchronized the users to Salesforce
- Since it didn't find a user with the FederationIdentifier, it created a new one 'User Dupe'
- We found this, deactivated 'User Dupe' and cleared FederationIdentifier, and set the correct one on 'User Real'
- However, the next user provisioning sync failed.
- The error message was unclear, but we found the user facing the issue based on a Salesforce User ID in the Entra ID provisioning error logs.
- We then tried to set some dummy FederationIdentifier on 'User Dupe' and tried a sync, and then we got a different error.
Probable Root Cause:
While one might assume that Microsoft Entra ID always retrieves users from Salesforce, before an update occurs towards Salesforce, it instead seems like Entra ID is caching a table of users based on Salesforce user ids, and updates based on this invalid cache mapping (FederationIdentifier -> SF User Id).
The bug overall seems to be in Microsoft Entra ID, so the issue should be raised with their support.
Sample Error Message Thrown in Entra ID:
EntrySynchronizationError
- Result: Failure
- Description: Failed to match an entry in the source and target systems User 'XX@YY.ZZ'
- ErrorCode: UnSpecified
- Error details: Invalid context
- ErrorMessage:
An error has occurred when attempting to match an entry in the source and target systems.
Review the common matching failures and error details for more information. Common matching failures:
- The target application does not support filtering on the matching attribute. Review your attribute mappings and ensure that the target application supports filtering on that matching attribute.
- The source entry does not have a value for at least one matching attribute. Review your attribute mappings to identify the matching attribute(s) and ensure that the entry has a value for those attribute(s).
- The target application denied the request due to an authentication or authorization failure. Ensure that the credentials you have provided have the necessary permissions for provisioning.
- There is an issue with the target application. It is unreachable, returned a non-specific error, or returned a non-SCIM compliant response. Contact the application developer.
