Cloud sync Provisioning Quarantined

Hello Timothy Boyette,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well. 

We will try to clarify your doubt and will suggest you solution. So, the provisioning job for Microsoft Entra Connect Cloud Sync has been placed into a Quarantine State because a high percentage of recent sync attempts have failed. The specific error, AzureDirectoryServiceAuthorizationFailed (Error Code 6), confirms that the underlying issue is an authentication failure between the Microsoft Entra Provisioning Agent (on-premises) and the Microsoft Entra Provisioning Service (in the cloud).

Grant admin consent for... is greyed out maybe because the automatically created sync service principal (which represents the Cloud Sync Agent in the Entra ID tenant) is either:

Blocked by Policy: The service account has been targeted by a Conditional Access Policy or MFA Policy that requires interactive authentication, which the non-interactive agent cannot provide.

Damaged/Missing Permissions: The service principal's required delegated permissions (e.g. to read AD and write to Entra ID) have been inadvertently removed or corrupted, making the Repair-AADCloudSyncToolsAccount command necessary.

We would recommend you below solutions:

1.Exclude the Cloud Sync Service Account from MFA/CA (Primary Fix): The Cloud Sync process uses a special service account named in the format MSOL_nnnnnnnnnn or similar (where n is a string of characters). This account must be excluded from all security policies that demand interactive authentication.

• First Find the Service Account: Identify the service account used by Cloud Sync (it often appears in the Sign-in logs for non-interactive sign-ins).
• Then Exclude from Conditional Access:

Go to Microsoft Entra admin center > Protection > Conditional Access.

Review all active Conditional Access policies (especially those that require MFA or block legacy authentication).

In the Users and groups section of those policies, explicitly add the sync service account to the Exclude list.

• Exclude from Legacy MFA:

If legacy per-user MFA is enabled, disable it for the sync service account.

more at: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates

https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-azure-mfa

Repair the Cloud Sync Service Account (Authorization Fix)

If above solution doesn't clear the quarantine, the service account itself may be corrupted or missing its permissions. The correct PowerShell cmdlet will re-provision the permissions and grant admin consent for the application.

Install the Tools Module: On the agent server, open PowerShell as an administrator and install the necessary module. Install-Module AADCloudSyncTools

Connect to Entra ID: Connect-AADCloudSyncTools (You will be prompted to sign in with a Global Administrator account.)

Run the Repair Command: This command deletes the existing Cloud Sync service account (MSOL_nnnnnnnnnn) and automatically recreates it with the necessary API permissions and roles, thus fixing the greyed-out "Grant admin consent" issue. Repair-AADCloudSyncToolsAccount

Clear Quarantine and Restart Provisioning

After applying the fixes, you must manually restart the provisioning process to clear the quarantine state: go to Microsoft Entra admin center > Microsoft Entra Connect > Cloud sync

Then Select the configuration that is in quarantine -> Select View status and then click the Restart provisioning button. This will clear the quarantine state and start a full initial sync cycle.

Please Refer the attached documents fir better understanding:
https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/how-to-troubleshoot

https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/reference-powershell

https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/how-to-prerequisites?tabs=public-cloud

Kindly let us know if the above helps or you need further assistance on this issue. 

Please "Accept the answer" if the information helped you and 'upvote' for it. This will help us and others in the community as well. Happy to help!

Regards,

Monalisha