Why does Azure AD or Google directory sync fail or show "Partial success"?

Short answer: Partial success means the sync finished with some users skipped. Check the sync history for the reasons. If the sync fails every day, the sync user's token has probably expired, so recreate the configuration.

Why it happens

• A user's email is invalid, or the user already exists in your account. Existing users are skipped by design.
• An attribute in the identity provider has no matching field in Kissflow.
• A synced group was renamed or removed on one side.
• The sync user's grant token expired or was revoked, for example after a password change.

How to fix it

1. Go to Account administration > User provisioning > Directory sync, open the configuration and click View sync history. See directory sync overview.
2. Fix invalid emails in your identity provider. Ignore users skipped because they already exist.
3. Check that each synced group still exists in both places. Remove it from the configuration, add it back, and click Sync now.
4. For token or grant errors, click More options > Delete configuration, then create a new one. Ask your Azure team to confirm the sync user's access is valid. See configuring Azure AD directory sync.
5. To keep departures aligned, set Google Workspace sync to deactivate or delete users in Kissflow when they're deleted in Google. See configuring Google Workspace directory sync.