Directory synchronization is currently in a pending disable state For More Than One Week

Question

I did disable Directory synchronization using powershell more than week ago and still in pending disable state and cannot enable it again.
When executing Azure AD Connect, I am getting the following error:

The Directory synchronization is currently in a pending disable state for this directory. Please wait until directory synchronization has been fully disabled before trying again.

Thanks.

Answer 1

@Nawaf Khalife As directory synchronization isn't activated or deactivated after 72 hrs, follow these steps, and then contact Support:

Run below PowerShell cmdlets:

• Connect-MSOLService
• (Get-MSOLCompanyInformation).DirectorySynchronizationStatus

If the output is "PendingEnabled" or "PendingDisabled" after the expected enablement time period has passed, this is a known issue with Exchange Online.
Collect the following information from the Windows PowerShell connection:

• Context ID: To collect the context ID, type the following cmdlet, and then press Enter:
  (Get-MSOLCompanyInformation).objectID
• Service instance: To collect the service instance, type the following cmdlet, and then press Enter:
  (Get-MSOLCompanyInformation).AuthorizedServiceInstances

-----------------------------------------------------------------------------------------------------------

Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.

Answer 2

Did you try steps mentioned here - https://support.microsoft.com/en-in/help/2654338/directory-synchronization-for-office-365-azure-or-intune-can-t-be-acti

In case you have, the only option is to contact Microsoft Support, they might need to make some changes in the backend to fix the issue.

Answer 3

Hello @Nawaf Khalife ,

Seems you had federation enabled? If that's the case, you need to convert the domain and all users to cloud-only auth. One way to toggle is indeed via the AAD Connect client, but you can also do so via PowerShell:

Set-MsolDomainAuthentication -DomainName domain.com -Authentication managed  

In case you didn't have password hash sync enabled, the cloud users will have to be "converted" as well:

Convert-MsolFederatedUser -UserPrincipalName ******@domain.com  

Thanks,
Manu