What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Find the stage where the request stopped before changing settings or retrying it. An identity governance workflow can be waiting for approval, stalled during workflow execution, queued for provisioning, blocked by a connector, or rejected by the target application; each has different evidence and recovery steps. First record the platform, workflow type, affected identity, target system, request or workflow ID, timestamp, current status, and exact error.
Start by locating the failure boundary
Use the request history and provisioning records to determine the last stage that completed. A sign-in or single sign-on problem is not the same as provisioning: provisioning uses a separate connector or API flow to create, link, update, or deactivate an account.
As an Amazon Associate I earn from qualifying purchases.
- Platform and workflow: Record the identity governance product and whether this is an access request, approval, lifecycle workflow, role activation, or account provisioning task.
- Identity and destination: Note the affected user or identity, source, target application, and expected account, role, attribute, or entitlement change.
- Correlation details: Capture the request or workflow identifier, start time or last-updated time, current state, and complete error text.
- Last completed action: Establish whether the request is awaiting a person, still executing, waiting in a provisioning job, or has received a target-side rejection.
Check status and logs before editing mappings, credentials, or workflow configuration. That preserves useful evidence and helps avoid changing a healthy stage while the actual blockage is elsewhere.
Match the symptom to the stage
| What you see | Where to investigate | Likely next action |
|---|---|---|
| Pending approval | Approval queue, approver eligibility, and the request’s expiration or timeout policy | Have an authorized approver decide, or submit a new request if the applicable policy says the old one expired. |
| Workflow remains in progress or has no expected next action | Workflow run history, execution state, and the failed or incomplete step | Use the platform’s run details to identify whether execution stopped before provisioning began. |
| Provisioning is delayed or the job is in quarantine | Provisioning job health, last synchronization, quarantine reason, and per-object logs | Address the recorded job or connection condition, then validate the affected identity’s provisioning result. |
| Create, link, update, or deactivate fails | Connector operation, target API or SCIM response, authentication, and identity matching | Correct the specific target, credential, matching, or configuration error before retrying. |
| Workflow reports success but access is absent | Target account, attributes, entitlements, role membership, and destination-side propagation | Verify the actual destination state and distinguish delayed display or propagation from an unfulfilled change. |
Resolve an approval wait before investigating provisioning
A request that has not passed approval may not yet have started fulfillment. Check whether the named approver can act, whether the request is still within its policy window, and whether the platform requires a particular approval sequence. Do not apply one product’s approval deadline to another platform.
Microsoft Entra PIM role and group activation
For Microsoft Entra Privileged Identity Management role activation, approvers can review requests at ID Governance > Privileged Identity Management > Approve requests, or query requests through Microsoft Graph. Microsoft Learn documents a 24-hour approval interval for the cited role and group activation requests; it is not configurable for these workflows. If a role activation request is not approved in that period, the eligible user must submit a new request. The request is resolved by the first approver to approve or deny it. An approver cannot approve their own role activation request, and a service principal cannot approve one.
For group activation, Microsoft documents the same 24-hour interval and recommends selecting two or more approvers for each group. These rules describe the specified Entra PIM workflows, not every access request or approval process.
Inspect provisioning job health and object-level logs
In Microsoft Entra, start with the provisioning job’s Current Status. Review the last synchronization, whether the initial cycle has completed, in-scope counts, quarantine state and reason, and the individual provisioning logs for the affected object. A job-level condition and an individual user’s failure are different clues: for example, invalid administrative credentials in a quarantine reason point toward the target connection, not an approval delay.
Free tools Windows power users keep installed
One-click scans. No signup required.
Microsoft says synchronizations typically occur every 20–40 minutes after the initial cycle completes. This is a typical cadence for the documented service, not a guarantee that every workflow or individual change finishes within that interval. Check the job state and object log rather than treating elapsed time alone as proof of failure.
Capture relevant records promptly. Microsoft’s planning guidance says most audit data is retained for 30 days, but retention depends on the applicable log type and tenant; verify the window for the records you need.
Validate the connection, matching, mappings, and scope
Where supported, use a controlled on-demand provisioning operation to isolate the failing step instead of repeatedly rerunning the full workflow. Microsoft Entra’s on-demand provisioning can test connection, retrieve the source identity, match it to a target account, evaluate transformations, and report the resulting action—create, update, delete, or skip. Its result view can show attributes changed or attempted.
Rank #4
- Connection: Confirm that the target tenant or service URL and credentials are valid. Read the target’s response, not just the identity platform’s summary.
- Matching: Confirm that the configured matching attribute is supported by the target and is unique for the intended account. Ambiguous or unsupported matching can prevent correct linking.
- Filters and scope: Check that the target supports the configured matching filters and that the identity is in the provisioning scope. Review the evaluated result to see whether the object was excluded or skipped.
- Expressions and transformations: Validate the expression and inspect the transformed values that would be sent to the target. A successful connection does not establish that a mapping is valid.
- Target operation: For SCIM applications, compare the target API response with the operation and response the provisioning service expects.
If an application assignment was just made, Microsoft notes that replication may take a few minutes before on-demand provisioning honors it. Retry the on-demand check after that brief replication interval rather than changing scope prematurely.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Classify connector errors before retrying
Okta provisioning
Okta Support defines a provisioning error as a failure to create, link, update, or deactivate a user through the SCIM connector, or an API authentication failure. Its article was last updated September 3, 2026. Use the error detail to distinguish an authentication problem from a target application rejection, an unsupported operation, or misconfiguration. Correct the underlying credentials or configuration and follow the platform’s guidance for retrying.
SailPoint Identity Security Cloud
Inspect the connector’s error details rather than assuming every failure is transient. SailPoint documents some errors, including ConnectException and NoRouteToHostException, as retryable. Retry only where the connector identifies the condition as retryable; invalid input, authorization failures, and target-side rejections require correction or resolution at the relevant system first.
Confirm fulfillment in the destination
A successful workflow status is not sufficient proof that the requested access is usable. Check the target application’s account, relevant attributes, and entitlements, and confirm that the expected role or group membership is present. Compare the destination state with the provisioning result to tell whether the account change was attempted, accepted, and reflected.
For an Entra role activation that appears complete but has not taken effect in another portal, Microsoft suggests signing out and back in, then verifying that the user appears as a role member in PIM. Web caching can delay the visible effect in a portal.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Record the resolution and preserve useful evidence
Once the destination state is correct, record the root cause, relevant request and provisioning identifiers, the error detail, and the corrective action. Keep the timeline tied to the identity and target so a later recurrence can be correlated across approval history, workflow execution, connector logs, and destination events. Platform labels, API coverage, tenant behavior, and log retention can change, so use the current product-specific records for the environment being diagnosed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
