Provisioning failed

A provisioning operation did not complete on the target system, an account was not created, a group not added, an entitlement not removed. Because provisioning is the last step of a long chain, the failure could be anywhere from policy to the connector, so a methodical read of the evidence is essential.

Open the provisioning transaction for the request. It records the compiled plan, any policy decisions, approval status and the connector result, including the actual error the target returned. This single artifact usually tells you exactly where the flow stopped.

• Connector credentials expired or wrong, the service account cannot authenticate to the target.
• Insufficient rights, the service account authenticated but lacks permission to make the change (a very common "insufficient access rights" error on AD).
• Policy block, a separation-of-duties violation quietly prevented the change.
• Pending approval, the change is not failed but waiting.
• Network/firewall, the task/VA host cannot reach the target.

• Read the provisioning transaction to identify the failing stage.
• Verify the connector service account credentials and its rights on the target for this operation.
• Check for policy violations on the request.
• Confirm no approval is still pending.
• Fix the root cause and retry, then confirm the change on the target via the next aggregation.

Monitor provisioning transactions for failures rather than assuming success; grant connector service accounts exactly the rights they need; and alert on repeated connector-auth failures so expiring credentials are caught before they break provisioning.

• Guessing instead of reading the task/transaction result, which usually names the cause.
• Fixing the symptom, not the root cause, so it returns.
• Changing several things at once, so you cannot tell what worked.