o365 Incorrectly disabling\sign in blocking an account - repeatedly

[mbedford]

Hi,

 

I need some assistance here. O365 Dirsync is consistently blocking the ability to sign in a specific user. We are syncing our active directory domain to the O365 tenant (almost 1000 users) its only affecting this one. The person is not disabled on prem and there is nothing this side of o365 suggesting he should be blocked. I can enable sign in via the admin portal and his account works, for a few hours and then it goes again (probably around the time dirsync runs its update)

 

Looking at the logs this is what i can see

 

 

Anyone have any idea what could be causing this?

I have ruled out the usual suspects of bad password on a mobile device, almost certain its a dirsycn issue, but only 1 user out of nearly a 1000 seems unlikely.

[Steve21]

Whats the dirsync logs say? It'd tell you what it's updated on the user if it's run something against the account

 

Steve

[mbedford]

Do you happen to know where the logs are kept on the local machine? I have checking the documentation and it appears to point primarily to to the Azure portal which is where I found the posted info.

[Oaktech]

I'd lay money on switched user scenario and a running browser/app repeatedly attempting to sign in with an old set of credentials and locking it out.

[mbedford]

My initial thoughts were similar. but in the Azure audit log is saying the disable event was initiated by my Azure AD Connect client (DirSync)

 

 

The on prem account in active directory is working fine, no bad password attempts and can log in to everywhere they should be able to.

[chaplic]

Are you sure the account in the cloud and the account on prem are one-and-the-same.

 

Get the immutable ID from the cloud object (get-msoluser [email protected] look for immutableID)

 

Convert this to ms-ds-consistencyguid which is (probably) the AD field that links the two

 

 

powershell - How to return user with specific ms-DS-ConsistencyGuid based on filter query - Stack Overflow