Azure AD Sync Export Error “Permissions-Issue”
Today i have been working on troubleshooting Azure AD Sync tool for one of my customer where they were having issues with the tool. MIIS client was reporting export errors for all the users in the organization and the error was “Permissions-Issue”. It was one of the interesting errors to work on and it took me a day to resolve the issue and i thought to share the remedy with all of you so that you should be able to resolve this issue within an hour.
Azure AD Sync Export Error
Whenever AAD Sync perform synchronization with office 365, evertime we were getting the error message on “Export”. If we look at the error message it says “Permissions-issue” and we verified that our on prem service account and Office 365 service account has all the required permission for AAD Sync tool. At one stage we thought it’s a false error but No it’s not a false error and it does have a solution. Below is the screenshot of error message that we were getting.
When you click on permission-issue you’ll see the following screenshot which is giving us the details of error message along with error code.
Let’s get started to resolve this error and below are the steps that we need to perform to resolve this issue.
Resolve AAD Sync Export Error
If you click on Permission-Issue to see the detail you’ll see that Connected date source error code is 8344. To resolve this issue, perform the following steps
1. Run Active Directory Inheritance script to get a list of users on which inheritance is blocked. Once you’ve the list pls make sure that you allow inheritance on those users/groups.
To allow inheritance, Make sure Advance Features are enabled in View then go to user properties –> Security –> Advanced –> Select the check box “to include inheritable permissions from this object’s parent”
2. Make sure you’ve the required on prem permissions assigned to Azure AD Sync tool service account. You can assign the appropriate permissions to Azure AD Sync tool by following this article.
3. Once you’ve check the inheritance and required permissions. Make sure that the service account is a part of AAD Sync security group in active directory. The name of security group is MSOL_AD_Sync_RichCoexistence. After you add the service account to the group, re-run the full synchronization and you will see that all permission-issue errors are gone.
In my case, customer was using AAD Sync along with password sync and they had Exchange 2010 SP3 hybrid configured.
Hope this article will help you resolve your issue with Azure AD Sync tool. Please feel free to ask us in case you have other issues. Thanks.
Riaz is a technology evangelist with over 8 years of extensive experience with expertise on Identity Management, Exchange Server, Office 365 and a bit of System Center. Riaz is currently working as Lead Consultant. His technical experience is followed by 8 years consulting positions advising both internal and external (local & International) stakeholders/customers on strategic technology selection and adoption along with delivery of solutions across a range of business units. He is a regional lead speaker for Microsoft Office 365 and also speaks in community forums.
Leave a Reply
You must be logged in to post a comment.
2 replies on “Azure AD Sync Permissions Error: Error Code 8344”
I am now not sure the place you’re getting
your info, however good topic. I must spend some time learning much more or understanding more.
Thanks for great info I used to be on the lookout
for this info for my mission.
Hi,
The best place to learn is technet and your lab. Play as much as you can with your lab servers and study as much as you can on techent. Feel free to ping us in case you’ve any question. Thanks.