Use this table to find the cause of a mapping error and fix it yourself.
Problem
Provisioning works for some users or fields and fails for others. The Microsoft Entra ID provisioning log shows an error.
Cause and steps
Open the failed step in the provisioning log (see How to Read Provisioning Logs and Find the Cause of an Error). Find your message in the table.
| Message | Cause | Steps |
|---|---|---|
first_name "This field cannot be empty" (missing_field), or FreshserviceMissingField: first_name | givenName is empty in Microsoft Entra ID. This is common for guest and service accounts. | Fill in givenName for those users, or keep them out of scope. Do not remove the givenName mapping, because first name is mandatory. |
invalid_field "Unexpected/invalid field in request" | The field name is wrong, or the field does not exist in Freshservice. | Create the field in Freshservice first. Copy the exact name from Admin > Apps > Azure Active Directory provisioning (SCIM) > Settings (case-sensitive, no angle brackets). Custom fields use freshservice:2.0:User. Only department and manager use enterprise:2.0:User. |
datatype_mismatch | The type in Freshservice does not match what is sent. | Microsoft Entra ID always sends employee_id as a string, so make that Freshservice field a text field. See Invalid Field Values: Dropdown, Mandatory Field and Data Type Errors. |
BadRequest or SystemForCrossDomainIdentityManagementCredentialValidationUnavailable on new users | A matching attribute other than userName is set. | In the mappings, keep only userName as the matching attribute. Remove other matching attributes (for example, email, or Location). Keep the externalId mapping itself. |
UpdateForUnconnectedEntry | Microsoft Entra ID cannot find the Freshservice user. It can also hide a field error. | Open the failed step and read the detail. See Duplicate Users After an Email Change: How to Fix. |
EntryExportError: UnSpecified | A general wrapper. The real error is in the detail. | Open the failed step and look for one of the messages in this table. If the detail says access_denied, see OAuth Token Expired or Not Authorized Error: How to Fix. |
| New users fail, existing users update | A custom field is mapped but not created in Freshservice, givenName is empty, or a mandatory field is empty. | Check the three causes in order. |
| Department fills Division, or Company fills Department | The default department mapping was changed. | Map department to urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department. |
| Requesters are created as agents | isAgent is set to true. | Remove the isAgent mapping or set it to false for requesters. |
RedundantExport | Not an error. Nothing changed. | No action. |
If you cannot find sAMAccountName as a source, Microsoft Entra ID does not expose it. Copy it into an extension attribute in your directory sync and map that attribute.
After each fix, run Provision on demand for one user (see How to Test One User with Provision on Demand).
Sources
- KB: How to Read Provisioning Logs and Find the Cause of an Error
- KB: How to Test One User with Provision on Demand