Troubleshoot NIM provisioning failures
Troubleshooting guide
Find where a provisioning workflow stopped before changing its mapping, schedule, or target-system data.
At a glance
When NIM does not create, update, disable, or remove the expected target record, check the workflow in its execution order: current collected data, record relations, filter output, mapping configuration, target connection and permissions, then job results. Test one safe record manually after each correction. Do not enable or retry a broad schedule until the selected record has the intended target-system result.
Diagnose the failure in order
1. Confirm that NIM has current source and target data
Open the relevant system collection and confirm it completes successfully. Review the Vault to make sure the source record, target record when one exists, and the attributes required by the workflow are present and current.
If the required record or attribute is absent, correct the system connection, selected tables or columns, or collection issue before editing a filter or mapping.
2. Confirm that related records match correctly
If the workflow depends on data from more than one system, inspect its inter-system relation. The relation must identify the source record and the corresponding target record correctly. A missing or incorrect relation can make an existing account appear absent, or prevent a filter from finding a record that is present in both systems.
3. Test the filter output
Open the filter used by the mapping or role. Check that it returns the selected test record, excludes records that should not be processed, and contains every column the target operation needs.
- The record is not returned: review collection data, filter expressions, start table, and relations.
- The record is returned with missing values: review the selected columns, source data, lookups, generators, and relation items.
- Unexpected records are returned: narrow the filter and test representative records before running the job again.
4. Validate the mapping or role operation
Review the mapping or role that consumes the filter. Confirm it uses the intended target system and operation, and that required target attributes receive valid values. Use NIM validation to identify configuration errors before running the job.
For a direct account change, verify the mapping is included in the correct job. For maintained group membership or entitlement changes, confirm the role and its related operations are included in the job that is being tested.
5. Check the target connection and permissions
When the filter and mapping are correct but the target rejects or cannot apply a change, verify the target system configuration. The connector account, certificate, consent, API permissions, or delegated rights must permit the exact operation NIM is attempting. Use the selected integration's connection guide for its required permissions and run its connection test where available.
6. Review the job result
Run the job manually with the safe test record, then review its result. Use the result to determine whether NIM selected no records, stopped at validation, attempted the target operation, or received a target-system error. Keep the job result with the matching filter and mapping configuration when escalating an issue.
Common symptoms
| Symptom | Check first | Likely area |
|---|---|---|
| No records are changed | Filter output and job contents | Collection, relation, filter, or job configuration |
| The wrong records are changed | Filter output before running again | Filter criteria or relation |
| A record is selected but no target account exists | Mapping operation and target connection | Mapping configuration, target permissions, or connector setup |
| A target operation reports an error | Job result and integration guide | Required target values, permissions, certificate, consent, or API limits |
| A recent configuration change has no effect | Validation and service state | Configuration error or required service refresh |
Verify the fix
After correcting the identified layer, collect data again when the source or target changed, rerun the filter, and test one safe record through the job. Confirm the intended target-system change and review the new job result. Only then return the job to its normal sync task schedule.
For collection, filter, relation, validation, or service symptoms that are not specific to provisioning, see Troubleshoot NIM.