AWS Managed Account not updating after Microsoft Entra Connect Sync was installed

Question

Hi everyone, I've recently taken over some responsibilities from a coworker who left and a lot this is new to me, so please forgive me if any of this is explained poorly or if I'm just missing something. The coworker also was fairly new to AWS and a lot of this setup is a bit mangled, but I will explain.

We're trying to set up an AWS managed directory that's synced to our microsoft account. The end goal is to be able to have single sign on to accounts that are properly set up to have access to various AWS resources, using their microsoft account credentials. We've had our microsoft account for a long time, and we just started to use AWS. The AWS Directory is only partly set up.

We currently have 2 AWS directories, one that was previously created by the coworker, and one that I've been working on to try and get working from a fresh domain.

The previous one does have some manually created users that are being used to give some of our users access the resources on our AWS account. There was an attempt to sync with this domain, but the directory name did not match the domain name for the microsoft account, and its causing issues. It also has some Entra Sync errors, but these are mostly just duplicate entry errors because a lot of our groups and users have had the same email set at their contact email. Its an easy fix but since its not on the domain that I'm working on I haven't bothered with it.

The current domain is completely fresh, no users other than the domain user that is required for Microsoft Entra Sync Connect. The domain names match so theres no longer an error there. The Sync Connect installer worked perfectly. The instructions I followed are here:

Sync services doesn't give me any errors, and says that the syncs are performed correctly. The issue is that the AWS Active Directory is not updated.

The domain user that is created in the AWS directory and the Admin user is synced to the microsoft account like we would expect, but none of our users from the microsoft account are copied back to AWS. I don't seem to get any error messages.

As mentioned we have a few Entra sync errors, but they are for the other domain. Beyond that the only other error messages I get is in the event viewer, and that error is "the management agent "{our domain}" step execution completed on run profile "export" with errors.", with an error code of 6100. Digging into this, I found the log in the Sync Service Manager. The error is just that the sync service doesnt have permission to sync one of the users to Microsoft, error code 8344. This user seems to be one of the users that were automatically created, it's named "AWS_TRHgFN9hqSl", and Im not totally sure what it is, however its not a user we need in Microsoft. Since the domain user and admin user synced (As well as a test user that I will describe below) synced, I cant imagine that it would prevent it all from working.

I was wondering if we may have a misunderstanding of how Entra Sync Connect works, I wasn't sure if we needed to manually create the users in the AWS AD domain and then Entra will sync them. To test this I created a user that had all of the exact information that another user had. Once it synced, it had created a new user in our microsoft account that had the same name/email, just with a few numbers added.

If the connect sync does work the way I thought was supposed to, and it does create all the users from our microsoft domain in our AWS domain, it feels like its some kind of permissions issue. I logged into the EC2 with the AD tools as the domain user and it seems like I'm able to create new users no problem. Is there some other permission that the domain user needs? Or does the Entra Connect Sync just not work like we expected it to? Or am I just missing something here? Any help would be greatly appreciated!

Answer 1

Hi Zac Demmel,

Thank you for posting your query on Microsoft Q&A. I am Saiteja from Q&A will be assisting you with your query.

Based on your query, below is my understanding: You have created AWS AD directory and syncing them using Microsoft Entra connect.

Microsoft Entra connect works as a single way synchronization. If you have created a user in AWS directory and add them in sync scope you will be sync them to Microsoft AD account. This is the expected working scenario. You can only sync the users once you create them in your AD. If you want to sync from Microsoft Account to AWS AD which is not possible. I would suggest you go through this link to understand how an Entra connect sync works with synchronization.
I hope this information is helpful. Please feel free to reach out if you have any further questions. If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment"