Directory sync is off or failing

A client’s users aren’t updating — a new hire is missing, someone who left is still there, or a learner shows an old name — or the client’s health pill says the sync needs attention. The connection card at the top of the client’s People page tells you what’s wrong. Find its message below. The buttons that fix it appear only for admins with the Administrator role; Training Managers and View Only admins see the message without them.

Directory sync is off

The card says Directory sync is off. Nothing from the client’s directory reaches us while it’s off: no new users, no removals, no name or department changes. Sync Now is unavailable until it’s back on.

On the People page, click Turn on.
We check the connection first. If it works, sync turns on and a sync starts right away — you’ll see Syncing your directory while it runs.
If the check fails, sync stays off and the card shows why, with a button for the fix. Find that message below, fix it, then click Turn on again.

The Google account that authorized this sync was deleted or revoked access

Some older Google connections run on the sign-in of the one admin who first connected them. When that admin’s account is deleted or their access is revoked, the sync stops.

Click Set up domain-wide delegation and follow the steps: add our Client ID and scopes in the client’s Google Admin, then click Test DWD Connection. Once it passes, the sync runs through any active Google admin, so it keeps working when people leave. Then click Turn on if the sync is off.

Google hasn’t authorized INFIMA’s Client ID for the scopes the sync needs

Google is refusing our sync because domain-wide delegation is missing or incomplete in the client’s Google Admin. When only some scopes are missing, the message lists them.

In admin.google.com, go to Security → Access and data control → API Controls → Manage Domain Wide Delegation.
Find our Client ID, or click Add new if it isn’t there. Paste the Client ID and the full scope list from the copy buttons in our DWD panel (click Set up domain-wide delegation beside the message).
Click Authorize, wait a few minutes, then click Test DWD Connection. A new delegation often fails for the first minute or two.

Domain-wide delegation isn’t set up yet

Google was connected, but the domain-wide delegation test never passed, so nothing can sync. Click Set up domain-wide delegation, add our Client ID and scopes in the client’s Google Admin, then click Test DWD Connection.

None of the Google admins this sync acts as exist any more

Every Google admin we had on file for the client has been deleted or renamed. Reconnect Google so we can record the current admins: click Reconnect Google Workspace…, which takes you through Switch Provider, then connect Google again with a current admin account. You’ll pick All Users or groups again afterwards.

Someone removed or disabled our app in the client’s Microsoft Entra ID, or never finished admin consent. Click Reconnect Microsoft Entra ID…, which takes you through Switch Provider, then connect Microsoft and approve admin consent with a Microsoft 365 admin account. You’ll pick All Users or groups again afterwards. If the client’s admin should do it instead, send them a sync-link invite.

Microsoft can’t find this tenant any more

Microsoft no longer recognizes the tenant this sync was connected to — for example, the client moved to a new Microsoft 365 tenant. Click Reconnect Microsoft Entra ID… and connect Microsoft with an admin account from the client’s current tenant.

The directory refused access

Microsoft or Google refused to let us read the directory or a group. Check that the admin account or app we sync through still has admin rights in the client’s directory, then click Sync Now.

Group not found

A Microsoft or Google group you chose to sync was deleted in the client’s directory. The sync stops until you fix it, so nobody is added or removed in the meantime. Click Choose groups again, then pick Sync All Users, or Choose Groups and the groups that exist now.

A synced user’s name or details are out of date

Synced users’ names, email, department and manager come from the client’s directory, so there’s no Edit for them here. Change the detail in Microsoft 365 admin or Google Admin, then click Sync Now on the People page — or wait for the next automatic sync, which runs every 6 hours. If the card says sync is off or failing, fix that first; nothing arrives until a sync succeeds.

You’ll know it worked when

The card’s dot is green and shows Last synced a moment ago.
Directory sync is off and the red error box are gone.
The client’s health pill moves back up on its own.

Frequently asked

Why was this client’s sync off in the first place? Usually because it kept failing in a way only the client’s side can fix — most often, the Google admin who authorized it was deleted — and we switched it off rather than let it keep failing. Turning it back on checks the connection first, so it won’t just start failing again.

Can I turn a client’s sync off myself? No. If you want to stop a person from being synced, deactivate them on the People page, or sync by groups and leave them out.

I fixed the problem. Do I need to do anything else? If the card still says Directory sync is off, click Turn on. Otherwise the next automatic sync picks it up, or click Sync Now to run one immediately.

The test passed, but the client’s users still haven’t changed. Check the card a minute later — a sync takes a little while to finish. If it shows a new error, look it up on this page.

Sync setup — provider details and fallbacks — the full Google domain-wide delegation walkthrough and sync-link invites.
Client health status — what moves a client’s health pill.
Google sync fails with admin_policy_enforced — when Google blocks the sign-in itself.

Directory sync is off or failing