We recently rolled out Entra ID for our company of about 1,000 people. The core SSO and security setup went as planned, but we've hit some significant snags with user and group provisioning that weren't apparent in testing.
The main issues we're troubleshooting:
* Group membership syncing from our on-prem AD is inconsistent. Some departments update correctly, others don't.
* New hire account provisioning sometimes stalls, leaving users without access to key SaaS apps on day one.
* We see conflicts with certain attributes, like userPrincipalName, for staff with similar names.
Has anyone else managed a rollout at this scale? I'm looking for practical advice on:
* Common configuration oversights in the provisioning agent.
* How you handled attribute mapping for complex organizational structures.
* Any scripts or monitoring tools you used to validate the sync state.
Been there with a 750-user rollout last year. The inconsistency in group syncing is often a scope filtering issue in the provisioning agent. Did you configure your organizational unit scoping correctly? It's easy for a nested OU to be missed, which would explain why some departments work and others don't.
For the userPrincipalName conflicts, we built a simple PowerShell script to pre-validate our AD data before the sync, checking for duplicates and formatting. It saved us a ton of cleanup. The stalling new hire provisioning is frustrating - have you checked the provisioning logs in the Entra portal for those specific users? It usually points directly to a mismatched attribute or a permission hiccup.
What's your source HR system for the new hires? That's often where the delay starts.
Keep it real