How to troubleshoot Directory Syncing issues

The following are common errors that you could encounter when setting up directory syncing with Breach Secure Now and should serve as a guide to assist in resolving the issue. Should you still need assistance after reviewing this article or you find your error isn't listed, please make a ticket with our support team and an agent will follow up with you. 

Users not syncing

Generally, the first step to resolving this issue is to ensure you are receiving the "Directory Synchronization Reports". This report is an incredibly useful tool to leverage in troubleshooting. To review the account that these reports are being sent to. you can navigate to the Partner profile > Partner notifications > Setup > "Emails to receive directory sync errors" > [email entered here is where the automated reports go] 

Note: if you are using ConnectWise or Autotask, ensure that the "Directory Sync - Digest" is enabled under the Ticket Management Systems section in the Partner profile. 

For users to sync over to the PII Portal, they need to have a completed profile, which consists of the following being filled out in the user properties of the Azure/Google/On-premise:  

• First name field
• Last name field
• Email address field
• Account enabled/active on the directory
• User is a member of at least one of the BSN-XXX security groups

Users may be previously syncing to another tenant in the portal under your account or they could have been with another organization entirely that also used PII Protect in the past. In this scenario, reach out to support as well as your client to validate this and resolve the issue.

Google Workspace Syncing Issues

If you are experiencing an error when trying to upload the JSON file in the PII Portal after going through the step-by-step documentation please refer to the following information to resolve the issue. 

Things to check/likely culprits: 

1. OAuth Scopes - Use the following link to get to the domain wide delegation page (https://admin.google.com/ac/owl/domainwided)
   OAuth scopes should look like the following without any spaces:
    

   https://www.googleapis.com/auth/admin.directory.user.readonly

   https://www.googleapis.com/auth/admin.directory.group.readonly

   https://www.googleapis.com/auth/admin.directory.customer.readonly 
2. Ensure the correct client ID from the JSON is entered in the OAuth scopes in step 1
3. Ensure the Admin API is enabled for the project (https://console.developers.google.com/)

Onprem Syncing Issues

If you are experiencing issues with users not syncing after reviewing the general users not syncing steps above and going through the step-by-step documentation please refer to the following information to resolve the issue. 

Things to check/likely culprits: 

1. Review the clientID in the BSNADSync Agent to make sure it matches for the client in the portal. If the ClientID in the .config file doesn’t match what’s in the portal for the client, you can put in the correct one in the .config file, save it and then start and stop the service.  The .config file is located in the \Program Files (x86)\BSNADSync folder.
2.