syncing large group to azure misses some members

Liam Hoekenga
  8 hours ago
We’re syncing some large groups to Azure AD (~100k), and it’s taken multiple (4) runs of the full provisioner to get the membership to be near complete.
The two groups in question are also synced to AD (and for now are getting synced from AD to Azure AD using AAD Connect).
We’d like to go directly to Azure AD instead of having to go to AD -> AAD Connect, but we’re not sure we trust the Azure provisioner yet. :thread:

Liam Hoekenga
  8 hours ago
The first run of the full provisioner probably did 50-60% of the membership, each subsequent run has picked up a little more, and at this point we’re probably within 100 users in each of the two groups  (e.g.  the version from AD has 96558 members, but being directly provisioned into Azure AD has 96546).
The fulls are finishing with errors, but I can’t find errors in grouper.log or provisioning.log
The incrementals are finishing w/o errors, but are currently throwing NPEs early in the sync process and not really doing anything.