Entra sync issues
The Entra sync runs every morning (06:00, Sunday to Friday) and writes down everything it does. When something goes wrong — a person it couldn't create, a group it couldn't update, Microsoft turning the connection down — that's written down too, but among thousands of routine lines. Entra sync issues pulls those problems out and groups them, so one cause is one line however many people or days it affected.
Before you start
- You need permission to view sync status for the school.
- Entra sync should be switched on for the school (see Microsoft Entra settings). Anything already logged is still shown if it has since been switched off.
Steps
Step 1: Open Entra sync issues
Go to Entra sync → Issues in the sidebar. You can also get there from:
- the Entra sync → Status page (View issues, or Issues when there are none; see The Status page),
- the N issues to look at badge on the Microsoft Entra tile of the Sync status page and the Entra: N issues badge in the Sync centre on the dashboard — these appear only when there is something to look at,
- in MAT overview, Sync status → Entra sync issues, or the Issues column of the MAT sync status table.
Step 2: Choose the period
Use the menu at the top right: the last 24 hours, 7 days (the default), 14 days or 30 days, or Since the last successful sync. Periods are capped at 30 days. If the last successful sync was longer ago than that — or there has never been one — the page says so and shows the last 30 days.
Step 3: Start at the top
Issues are listed most serious first. Each one shows:
- A badge — Stops changes reaching Microsoft 365 (nothing, or nothing for these people, is getting through), Needs a look, or Usually sorts itself out (a one-off that normally clears at the next sync; a warning of that kind shows Warning).
- How many people are affected, how many times it was seen, and when it was first and last seen.
- What this means and What to do, in plain English, with a button to the page where the fix is made (only buttons you have permission to use are shown).
Problems we don't have an explanation for yet show What the sync reported with the message the sync wrote, and a note saying there's no plain-English explanation yet. If one of those keeps appearing, contact Realsmart support and quote it. With no problems in the period the page says No Entra sync problems and Nothing went wrong in this period; with Entra sync off it says Entra sync is off for this school (anything already logged is still shown).
Step 4: See who's affected
Select Show who's affected to list the people the issue hit, newest first, with their username, member type and when it last happened. Select a name to open their profile on the Cloud tab (names are links only if you can manage users, and only for the school you're in). Latest message from the sync shows the exact wording the sync logged. Up to 200 people are listed per issue. For an issue that isn't about particular people, the button reads Show the message.
The problems you're most likely to see
| Issue | What it means | What to do |
|---|---|---|
| Microsoft accounts aren't being created: the default password can't be read | A default password is saved for that member type (for example staff), but it can't be read, so the sync skips those people rather than create an account with no password. It repeats at every sync until fixed. | Re-save the default password for that member type in School settings → Password (the issue itself says "Settings → Password") — type it in again and save. The accounts are created on the next Entra sync. |
| Creating … with a random initial password: no default password for member type … (shown as What the sync reported, with no plain-English explanation yet) | The person had no readable password of their own and the school has no default password for their type, so their Microsoft account was made with a random password nobody is told. | Set a default password for that member type in School settings → Password for future accounts. For an account already made, reset the person's password (with Sync passwords to Entra on it's sent to Microsoft) or reset it in the Microsoft 365 admin centre. SmartLogin sign-in isn't affected. |
| A saved password couldn't be read | The password stored for these people can't be read, so the sync used the default password for their member type instead. | Set a new password for each person, or re-save the default password in School settings → Password. If the default can't be read either, you'll also see the issue above. |
| Microsoft 365 is refusing the sync: the client secret is wrong or has expired | Nothing is reaching Microsoft 365 for the school. Client secrets expire on the date chosen when they were created. | Create a new client secret on the Realsmart app registration, paste it into Entra sync → Settings → Connection, save, then use Sync status → Test connection. |
| Microsoft 365 doesn't recognise the app the sync signs in with | The tenant ID or client ID doesn't match an app registration that is allowed to sign in. | Check both against the app registration, save, then Test connection. |
| The Realsmart app isn't allowed to make these changes in Microsoft 365 | The app signs in but is missing a permission. | Grant the application permissions User.ReadWrite.All, Group.ReadWrite.All and AdministrativeUnit.ReadWrite.All, then Grant admin consent (see Microsoft Entra settings). If the message is about creating an administrative unit, accounts and groups are still syncing — only the administrative units are missing. Add AdministrativeUnit.ReadWrite.All itself (Directory.ReadWrite.All isn't enough), grant admin consent, then run Test permissions. |
| Microsoft 365 group removals are paused (card on your Dashboard) | Realsmart has far fewer people in your groups than Microsoft 365 does, so the sync stopped taking anyone out of Microsoft 365 groups. Additions still happen. | If people or groups went missing by mistake, put them back in Realsmart; the pause ends at the next Microsoft 365 sync. If the change was intended, contact Realsmart support. See Realsmart paused some changes to keep your groups safe. |
| Some people couldn't be added to their Microsoft 365 groups | They're missing from groups they should be in, so they may not see the right Teams, files or email lists. | Often clears on the next sync. If the same people keep appearing, check their Cloud tab to see whether their Microsoft account exists. |
| The sync couldn't check who is in some groups | Nobody was added to or removed from those groups this time. | Usually temporary. If it lasts several days, check the Group.ReadWrite.All permission. |
| Some groups couldn't be given their email address on your domain | The sync tried several times and gave up, so those groups still use their …onmicrosoft.com address. Everything else about them works. |
Check the domain is an accepted domain in the Exchange admin center, the Exchange Online app has Exchange.ManageAsApp with admin consent and the Exchange Recipient Administrator role, and the certificate in Azure matches the one uploaded to Realsmart (compare thumbprints). See Exchange Online app registration. |
| The Exchange Online certificate expires soon / has expired | Group email addresses stop being set when it expires. | Make a new certificate, add its .cer to the Exchange Online app in Azure, then upload the new .pfx in Entra settings → Group email addresses. |
| Group email addresses are switched on but not fully set up | The app ID, the tenant domain or the certificate is missing, so nothing is set. | Fill in what's missing in Entra settings → Group email addresses, or switch it off. |
| Realsmart couldn't get your Exchange Online certificate ready for the sync | The certificate is saved but no group addresses are being set. | Contact Realsmart support — there's nothing to change on your side. |
| People are waiting for a Microsoft 365 licence | Your tenant has no free licences of the type chosen for them, so they have an account but no email, Teams or Office apps. | Buy more or free some up in the Microsoft 365 admin centre (Billing → Licences). They're licensed on the next sync. See Microsoft 365 licences. |
| The licence chosen in Realsmart isn't in your Microsoft tenant | The licence chosen for students or staff has expired or been removed, so nobody in that group is licensed. | In Entra settings → Licences, select Check licences now, choose a licence your tenant has and save. |
| Realsmart can't read which licences your tenant has | Licences are still given out, but can't be listed or counted first. | Add Organization.Read.All (or LicenseAssignment.Read.All) to the Realsmart app registration and grant admin consent. |
| Some accounts couldn't be licensed: they have no country / A licence clashes with one these people already have / Some people couldn't be given a Microsoft 365 licence | Microsoft turned down the licence for these people; the message says why. | Follow What to do on the issue — see Microsoft 365 licences. |
| Licence removals were held back | Too many suspended accounts would have lost their licence in one run, so none did. | Check the suspended accounts are right; if they are, contact Realsmart support. |
| Could not make the group Private, so it gets no Team this run: … / Could not read the group's owners: … / Could not add owner … / Could not remove owner … / Error adding Team to Microsoft group: … (shown as What the sync reported, with no plain-English explanation yet) | A step of Create Teams failed for a group: making it Private, setting its teachers as owners, or creating its Team. The message says what Microsoft reported. The other groups carry on. | Often clears on the next sync. If it keeps appearing, check the app has Group.ReadWrite.All with admin consent (Test permissions), or contact Realsmart support with the message. |
| Team for group … waits for Microsoft to catch up with its new group or owners; the next run creates it | A group or its owners were made moments ago and Microsoft hasn't caught up yet. | Nothing to do: the next sync creates the Team. |
| The Entra sync stopped before it finished | The sync gave up part-way, so some changes didn't reach Microsoft 365. | Use Test connection. If it passes and this keeps happening, contact Realsmart support with the message. |
| Class Teams are paused: the Realsmart app needs more permissions / Class Teams can't be made without an Education licence | Class Teams with Assignments is on, but the app is missing EduRoster.ReadWrite.All or Team.Create, or your tenant has no active Education licence (Office 365 or Microsoft 365 A1, A3 or A5), so no class Teams are made or kept up to date. Everything else syncs as normal. | Add the permissions with admin consent and run Test permissions, or check the licence in the Microsoft 365 admin centre. If the message says Realsmart can't check your licences, grant Organization.Read.All. The card on your Dashboard goes at the next sync after that. |
| Microsoft refused some classes' class Teams | Usually the class's name: your tenant's naming policy blocks a word in it, or the address is taken. The other classes carry on. | Rename the group in Realsmart; the next sync makes its class Team under the new name. |
| A class Team couldn't be made | Microsoft 365 turned down this class or its Team, so it doesn't have a class Team yet. The other classes carry on. | The message under Show the message says why. The next sync tries again; if it keeps failing, contact Realsmart support with the message. |
| A class Team will be tried again / A class Team is waiting for Microsoft 365 | Microsoft 365 didn't make a class or its Team this time, for a reason that usually passes (it was busy, or a new class needs a little while before it can become a Team). | Nothing to do: the next sync carries on. If the same class is still here after a few days, contact Realsmart support. |
| Nobody is being taken out of class Teams for now | Far fewer people are in your classes in Realsmart than Realsmart added to their class Teams, which usually means people or groups went missing by accident. Additions still happen. | Put the missing people or groups back in Realsmart and this ends at the next sync. If the change was intended, contact Realsmart support. |
| Some people couldn't be added to or taken out of a class Team / A class Team was deleted in Microsoft 365 | A class Team's roster didn't change as it should have, or the class Team is gone from Microsoft 365 (Realsmart then leaves it alone for the rest of the school year). | Often clears on the next sync. Restore a class Team deleted by mistake from deleted groups in the Microsoft 365 admin centre within 30 days, then contact Realsmart support. |
| Microsoft 365 was busy | Microsoft 365 asked the sync to slow down or didn't answer in time, so some changes were put off. | Nothing to do — the sync tries again next time. If it's still here after a few days, contact Realsmart support. |
| Licence assignment isn't ready on Realsmart's side yet | Licence assignment is switched on, but part of the update that adds it hasn't been installed yet, so nobody is licensed. | Contact Realsmart support with the message — there's nothing to change on your side. |
Across a trust
In MAT overview, the page covers every school you can access that has Entra sync switched on. The same problem at several schools is one line that names how many schools it affects, and the list of people shows each person's school. Fix buttons aren't shown here because the settings are per school — switch to the school in the top bar to make the change. "Since the last successful sync" is only offered for a single school.
One person's Entra result
On a person's profile, the Cloud tab shows Last Entra sync result under Microsoft Entra: OK, Warning, Problem, Account not created or No recent activity (the sync hasn't logged anything for them in the last 14 days), with the explanation, the sync's message and when it last succeeded for them. A create the sync skipped leaves no account for Check live to find, so this is where the reason shows.
When the sync is failing for someone, a Not created in Microsoft 365 or Entra sync problem badge also appears at the top of their profile — select it to jump to the Cloud tab. See See what Google and Entra say about a user.
The Status page
Entra sync → Status shows whether Entra sync is Enabled for this school or Not enabled, the last 7 days of results from the sync log (Success (7d), Errors (7d) and Total (7d)), and a card saying how many Entra sync issues there were in the last 7 days and when the last successful sync was, with a View issues button. The Issues page is where you find out why something didn't work. The page's Configure settings button opens the older settings screen; use Entra sync → Settings in the sidebar instead.
Issues page or Logs page?
Both show Entra problems. Until 16 September 2026 most per-person Entra entries were missing from the general Logs and Sync status pages; that's fixed, and earlier entries have been filled in. Use Logs to see everything the Entra sync did, successes included, one line at a time. Use this page when you want the problems only, grouped so one cause is one line, with what to do about each.
The Microsoft 365 launchpad widgets record their own problems in the same Entra log (as LAUNCHPAD_MS), but they aren't Entra sync problems, so they never appear on this page or in its badges. They show on Entra sync → Launchpad widgets and in the bell instead — see Launchpad widgets (Microsoft 365).
Result
You can see every Entra sync problem from the period in one short list, know which ones are stopping accounts reaching Microsoft 365, and go straight to the page where each one is fixed.
Did this work for you?
If a step looked different on your site, tell us and we'll update the screenshots.
Thanks for your feedback.