Restart-MgSynchronizationJob
SYNOPSIS
Restarts synchronization jobs for one or more Entra ID applications.SYNTAX
ByDisplayName (Default)
ByObjectId
DESCRIPTION
Resolves the target service principal(s) by ObjectID or DisplayName (wildcards supported), retrieves all associated synchronization jobs, then restarts them via the Microsoft Graph API. Two authentication modes are available:- Interactive : prompts for sign-in with delegated permissions.
- Managed Identity (RunFromAzureAutomation) : uses the managed identity assigned to the Azure resource (Automation Account, Function App, VM, etc.) - no credentials required.
EXAMPLES
EXAMPLE 1
Restart-MgSynchronizationJob -ObjectID ‘xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx’ Restarts all synchronization jobs for the application identified by its ObjectID.EXAMPLE 2
Restart-MgSynchronizationJob -DisplayName ‘Workday to Entra’ Restarts all synchronization jobs for the application named exactly ‘Workday to Entra’.EXAMPLE 3
Restart-MgSynchronizationJob -DisplayName ‘Provisioning’ Restarts all jobs for every application whose name contains ‘Provisioning’.EXAMPLE 4
Restart-MgSynchronizationJob -DisplayName ‘Workday to Entra’ -RunFromAzureAutomation Restarts all jobs for the matching application using Managed Identity authentication. Suitable for use in Azure Automation runbooks.EXAMPLE 5
Restart-MgSynchronizationJob -DisplayName ‘Workday*’ -ForceNewToken Forces a new Graph token before resolving applications and restarting jobs.EXAMPLE 6
Restart-MgSynchronizationJob -DisplayName ‘Workday to Entra’ -ResetScope ‘Escrows’ Retries only the objects currently in escrow (errored), without reprocessing the full directory.EXAMPLE 7
Restart-MgSynchronizationJob -DisplayName ‘Workday to Entra’ -ResetScope ‘Watermark, Escrows’ Combines a full directory re-evaluation with an escrow retry.EXAMPLE 8
Restart-MgSynchronizationJob -DisplayName ‘Workday to Entra’ -ResetScope ” Emulates the “Restart provisioning” button in the Entra portal (equivalent to QuarantineState + Watermark + Escrows with no explicit criteria body).PARAMETERS
-Confirm
Prompts you for confirmation before running the cmdlet.-DisplayName
Display name of the target service principal(s). Supports wildcards (* and ?):- “Workday*” matches all apps whose name starts with “Workday”
- “Provisioning” matches all apps whose name contains “Provisioning”
- “Workday to Entra” exact match (no wildcard) Cannot be combined with -ObjectID.
-ForceNewToken
Disconnects the existing Microsoft Graph session before connecting, forcing a fresh token to be acquired. Useful when the current token has expired or lacks required scopes.-ObjectID
ObjectID (GUID) of the target service principal. Cannot be combined with -DisplayName.-ResetScope
Comma-separated combination of synchronizationJobRestartScope values controlling what is reset when the job restarts. Values can be combined (e.g. “Escrows, QuarantineState”). Supported values:None Starts a paused or quarantined provisioning job.
DO NOT USE.
Use the Start synchronizationJob API instead.
ConnectorDataStore Clears the underlying cache for all users.
DO NOT USE.
Contact Microsoft Support for guidance.
Escrows Provisioning failures are marked as escrows and retried.
Clearing escrows will stop the service from retrying failures.
Watermark Removing the watermark causes the service to re-evaluate all the users again, rather than just processing changes.
QuarantineState Temporarily lifts the quarantine.
Full Use this if you want all of the options (Escrows + Watermark + QuarantineState).
ForceDeletes Forces the system to delete the pending deleted users when using the accidental deletions prevention feature and the deletion threshold is exceeded.
An empty string ("") emulates the “Restart provisioning” button in the Microsoft Entra admin
center.
It is similar to setting resetScope to include QuarantineState, Watermark, and Escrows,
and meets most customer needs.
If you use RunFromAzureAutomation, you need to explicitly choose a reset scope, as the portal default relies on delegated permissions which are not available with Managed Identity authentication.
Default : ‘Escrows’ (most common use case - retry errored objects without reprocessing
the entire directory).
Reference: https://learn.microsoft.com/en-us/graph/api/resources/synchronization-synchronizationjobrestartcriteria
-RunFromAzureAutomation
Authenticates using the Managed Identity of the Azure resource. Use this switch when the function runs inside:- Azure Automation runbooks
- Azure Functions
- Azure VMs / Container Apps with a managed identity enabled
-WhatIf
Runs the command in a mode that only reports what would happen without performing the actions.CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.INPUTS
OUTPUTS
NOTES
In the logs, you can filter onconfigurationCategory: ProvisioningManagement and Activity Type: Enable/restart provisioning.
Required Microsoft Graph permissions:
- Application.Read.All
- Synchronization.ReadWrite.All
- Microsoft.Graph.Authentication
- Microsoft.Graph.Applications