Issue Summary

After configuring provisioning as per the instructions here: Atlassian Cloud provisioning tutorial, the initial sync. works, but after a period of time the sync fails with this message on the Azure AD portal:

Quarantined due to a high number of errors. Please view the audit logs below to assess the errors and remediate them. Sync interval reduced to once per 24 hours.​

Environment

• Azure Ad
• Provisioning via SCIM

Steps to Reproduce

1. Configure provisioning with Azure AD as per the instructions here: Atlassian Cloud provisioning tutorial
2. Select/check the "Clear current state and restart synchronization"
3. Save the configuration
4. The sync. process will start/complete
5. Wait a while - testing has shown that sometime between 20mins and 2hrs the sync. will fail the message mentioned in the Issue Summary

Expected Results

• Sync. will continue to run

Actual Results

• This message is shown in the Provisioning configuration page on Azure AD:

  Quarantined due to a high number of errors. Please view the audit logs below to assess the errors and remediate them. Sync interval reduced to once per 24 hours.​

• 401 responses from the Atlassian global proxy
• In most cases, clicking "Test Connection" in Azure AD will return an error:
  

Notes

• You may need to switch between the two "Scope" options on the Azure AD configuration page i.e. toggle between "Sync all users and groups" and "Sync only assigned users and groups"
• Checking "Clear current state and restart synchronization" may be necessary to reproduce the issue

Workaround

• Regenerate/rotate the API key(reference: User provisioning):

  1. Go to admin.atlassian.com and click your organization.
  2. Click Directory, then click User provisioning.
  3. Click the Directory tab, then click the Regenerate API key button.
  4. Click Regenerate key.
  5. Copy the organization ID and the API key to a safe place. Once you close the API key information screen, we won't show you this information again.
  6. Click Done.

• Enter the new key into the "Secret Token" field on the Azure AD provisioning configuration page
• Click "Test Connection" - the test should pass
• Save the configuration
• The sync. should restart