>
    Strata Copilot
    Troubleshoot Cloud Identity Engine Issues
    Focus
    Download PDF
    Focus
    1. Home
    2. Identity
    3. Troubleshoot the Cloud Identity Engine
    4. Troubleshoot Cloud Identity Engine Issues
    Download PDF
    Identity

    Troubleshoot Cloud Identity Engine Issues

    Table of Contents

    Troubleshoot Cloud Identity Engine Issues

    If you are encountering issues with the Cloud Identity Engine, refer to the following table for common issues and solutions.
    Where Can I Use This?What Do I Need?
    • NGFW
    • Prisma Access
    		The Cloud Identity Engine service is free; however, the enforcement points utilizing directory data may require specific licenses. Click here for more information.
    If you are encountering specific issues when using the Cloud Identity Engine, refer to the following table for common issues and solutions. If you are still experiencing issues, be sure to review how to Monitor Cloud Identity Engine Status and the Cloud Identity Engine Troubleshooting Checklist.
    What Do I Do If...Resolution
    When I click Create to create the SCIM Connector application in the Azure AD Portal, a Not found error displays.
    Refresh the page and recreate the SCIM Connector application.
    The Azure AD Portal displays that the sync is complete and there is a steady state for the SCIM Connector, but the user and group count does not display. If the user and group count does not display, the sync is not fully complete. To resolve the issue, complete the following steps:
    1. Verify the provisioning mappings, scope, and other settings are correct.
    2. Restart provisioning and wait for the sync to complete.
    The sync for the SCIM Connector is unable to complete due to duplicate group names. Group names must be unique; resolve the duplicate group names so that they are unique and Restart provisioning.
    If you are unable to resolve the duplicate group names and you don’t need data from the duplicate groups or to use them in security policy, you can continue the setup.
    I checked the status of the agent on the Directories page and the status is “In Progress” but no groups or OUs are listed. While the domain is being synced, the In Progress status appears on the Directories page. If this is the first time the Cloud Identity Engine is syncing the domain, the groups and OUs may take some time to appear. If they do not display, delete then re-create the Cloud Identity Engine tenant and add the domain(s) again.
    The hub does not redirect to display my Cloud Identity Engine tenants or displays a blank page. If this issue occurs, contact support (see Get Help).

    © 2026 Palo Alto Networks, Inc. All rights reserved.