Fix Azure AD Sync Errors Using IdFix Tool

When you implement a hybrid setup of your on-premises infrastructure with Office 365, you also enable the Active Directory synchronization to Azure Active Directory via Azure AD Connect.

In this scenario, your Active Directory objects are synchronized to Azure AD for a single sign-on or unified login experience.

In some cases, directory synchronization errors happen when the source objects are in a bad state. Consequently, those objects can’t properly synchronize and can cause all sorts of problems for the affected users.

idfix azure

ADVERTISEMENT

When you encounter those synchronization errors, identifying the exact reason may be challenging if done manually. But don’t worry because the IdFix tool can help identify and resolve these errors.

What Errors Can the IdFix Tool Identify?

The first thing to be made clear is that the IdFix will not magically fix all your synchronization issues. It can identify the issues and suggest a resolution, but you still have to decide on the fix.

So what issues can IdFix identify that cause a bad state on objects? In a gist, here is the high-level list.

  • Invalid characters, like leading space characters in the mailNickName.
  • Objects with duplicate values for unique attributes, like the SMTP email address in the proxyAddresses attribute.
  • Non-routable domains, like @domain.local.
  • Invalid email address parts, like “some one@somecompany.com” or “someone@somecompany.com”.
  • A required attribute is empty, such as if a remote mailbox user has a blank alias.

Now that you’re acquainted with the Microsoft IdFix tool, let’s see it in action.

Install the Microsoft IdFix Tool

First, download the Microsoft IdFix tool installer on your server at https://go.microsoft.com/fwlink/p/?linkid=2138471. This link downloads a file called setup.exe.

azure idfix

Run the setup.exe file after downloading. This installer is a ClickOnce installation format and may warn you that the publisher cannot be verified. You can safely ignore this warning and click Install.

azure idfix tool

Wait for the Microsoft IdFix tool to finish installing.

idfix tool azure

Read and acknowledge the IdFix privacy statement by clicking OK.

ADVERTISEMENT

idfix

Identify and Fix Attribute Errors with the IdFix Tool

Once the IdFix tool is open, you’ll see a similar window, as shown below. Click the Query button to start identifying the attribute errors that may exist on your local AD objects.

idfix tool

As you can see, this example shows several issues that may prevent successful object synchronization.

The result shows the affected object and class (user, group), the erring attribute, and the cause. It also includes the column showing the value containing the error and the suggested update.

At this point, you need to analyze the issues and decide the actions to take.

idfix tool for azure

ADVERTISEMENT

Apply Individual Fix to Objects

For example, the first error shows that the proxy address for Aten Stig has an error because the SMTP address has a space character. The IdFix tool recommended fix in the update column is to remove the space. You can also directly edit the new value in the cell.

In the ACTION column, select EDIT. In this example, let’s choose to fix the first error and click Apply.

Note. Clicking Apply will change only the objects with a selected ACTION.

microsoft idfix tool on azure

You’ll get a confirmation prompt. If you’re confident of the selected actions, click Yes to confirm.

idfix microsoft azure ad

Once the fix is applied, the ACTION changes to COMPLETE.

microsoft idfix azure

Accept All Suggested Updates

You can also let the IdFix tool apply the suggested updates to all objects. But you must only choose this option if you’ve carefully reviewed and assessed that the proposed updates are suitable and accurate.

ADVERTISEMENT

Re-run the Query to refresh the objects with the errors list, review the errors and suggested fixes, and click Accept.

idfix azure tool

The IdFix tool then asks you to confirm to accept all updates. Click Yes.

idfix microsoft azure active directory

The ACTION column will automatically fill with the suggested actions, as shown below. Lastly, click Apply to apply these changes.

azure ad idfix

Confirm by clicking Yes.

azure ad connect idfix

Reverting Changes

Sometimes you need to undo the changes you made to objects. And if you made those changes using the IdFix tool, you have one level of undo because the latest changes are stored in a transaction log.

Because you can only retract your changes in one step back, it is recommended to keep them small, review the results afterward, and run the undo if needed.

To undo the latest changes done by the IdFix tool, click Undo, choose the LDF file, and click Open.

idfix azure ad connect

Once the record is loaded, click Accept and Apply to undo the last changes.

idfix dirsync

Conclusion

If everything goes well, the directory sync errors should disappear from your tenant in the following Azure AD Connect sync cycle.

idfix microsoft azure active directory synchronization tool

The Microsoft IdFix tool is an excellent aid for identifying the source of directory object sync errors. But it is not magic. As the administrator, you are responsible for ensuring that any fixes and updates are applicable and accurate.

I enjoy technology and developing websites. Since 2012 I'm running a few of my own websites, and share useful content on gadgets, PC administration and website promotion.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.