🔧 Recipe · Troubleshooting & Diagnostics

Review OneDrive, SharePoint, and Exchange Sync Failures Using Service Health and Sign-In Logs

Correlate Microsoft 365 service health incidents with Entra sign-in failures to diagnose weekend sync outages across Exchange, SharePoint, and OneDrive

Complexity

Intermediate

Impact

troubleshooting + monitoring + incident-response + microsoft-365 + entra-id

Context

Why This Matters

When users report that Outlook, OneDrive, or SharePoint stopped syncing during off-hours — a weekend, holiday, or overnight window — the root cause is almost always one of three things: a Microsoft-side service incident, a tenant-wide authentication or Conditional Access change, or a per-user credential/token problem. Manually opening each user ticket wastes time when a single 10-minute sweep of Service Health plus Entra sign-in logs will tell you which bucket the incident falls into.

This recipe walks through the correlation workflow admins should run first thing Monday morning (or immediately after any reported sync outage). It pulls active and resolved service health issues for Exchange Online, SharePoint Online, and OneDrive for Business, then joins that data with sign-in failures scoped to the sync client apps (OneDrive, Outlook, SharePoint, Microsoft OneNote Sync, etc.) across the incident window.

Run this when: multiple users report sync issues at once, Help Desk ticket volume spikes after a weekend, or you receive a Microsoft message center advisory and want to confirm which of your users were impacted.

Expected Outcomes

After completing this recipe you will have:

A list of active and recently resolved Microsoft service health issues affecting Exchange Online, SharePoint Online, and OneDrive for Business during the incident window.
A categorized report of sign-in failures (by user, app, error code, and timestamp) for sync-related clients during the same window.
Clear identification of the failure pattern: Microsoft service incident, tenant-wide misconfiguration (Conditional Access, MFA), or individual user/credential issues.
An action list — which users need password resets, session revocations, or MFA re-registration, versus which tickets can be closed with a "Microsoft-side incident, auto-resolved" note.
Exportable CSV evidence for the incident ticket or post-incident review.

Risks & Considerations

Warnings and gotchas

ServiceHealth.Read.All is required to query /admin/serviceAnnouncement/issues. The older /serviceAnnouncement/issues path is deprecated — use the /admin/ prefix.
Sign-in logs require Entra ID P1 or higher. Tenants on the free tier will not have /auditLogs/signIns data available.
Graph filter syntax is strict. Combining status/errorCode ne 0 with createdDateTime ge ... and contains() in a single $filter often returns HTTP 400. Build queries incrementally — filter by date on the server, then filter by app name client-side.
Do not bulk-revoke sessions across all impacted users as a knee-jerk response. If the cause is a Microsoft service incident, revocation adds no value and forces users to re-authenticate unnecessarily.
Error code 53003 (Conditional Access blocked) over a weekend frequently points to a policy change that was deployed Friday afternoon. Check policy audit logs before assuming user error.
PII and retention: sign-in log exports contain UPNs and IP addresses. Store CSVs in a compliance-appropriate location and purge per your data retention policy.

Required Permissions

Permission	Why It's Needed
ServiceHealth.Read.All	Read Microsoft 365 service health issues and message center advisories for Exchange, SharePoint, and OneDrive.
AuditLog.Read.All	Query Entra ID sign-in logs to identify authentication failures tied to sync clients.
Directory.Read.All	Resolve user principal names and enrich sign-in log entries with display names and department.
User.Read.All	Look up impacted user details when preparing remediation actions.

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

Review OneDrive, SharePoint, and Exchange sync failures that occurred between {start_datetime} and {end_datetime}. Pull relevant Microsoft Service Health issues, correlate with Entra sign-in failures for sync client apps, group by error code, and report which failures match a Microsoft incident versus which users need individual remediation.

Try in Dex Pro

For End Users

How an employee would ask Dex for help

My Outlook and OneDrive have been stuck syncing since this weekend — can you check if there's a problem with my account?

Try in Dex Playground

Step-by-step: Review sync failures via the admin portals

Part 1 — Check Service Health

Sign in to the Microsoft 365 admin center at https://admin.microsoft.com with a Global Reader, Service Support Admin, or Global Admin role.
Navigate to Health → Service health.
Set the filter to All services, then check the boxes for Exchange Online, SharePoint Online, and OneDrive for Business.
Switch the view to All active issues and also review History for the past 7 days to catch resolved weekend incidents.
For each relevant issue, click into it and record: issue ID, title, impact statement, user impact, start/end times.

Part 2 — Review sign-in failures in Entra

Open the Microsoft Entra admin center at https://entra.microsoft.com.
Go to Identity → Monitoring & health → Sign-in logs.
Click Add filters and set:
- Status: Failure
- Date: Custom range covering the incident window (e.g., Saturday 00:00 to Sunday 23:59)
- Application: OneDrive, Outlook, SharePoint Online, Microsoft Office, OneNote Sync
Review the result set. Click any row to expand and inspect the Basic info, Conditional Access, and Authentication details tabs.
Group failures by error code:
- 50126 — Invalid credentials (user-level, needs password reset or re-auth)
- 50055 — Password expired
- 53003 — Blocked by Conditional Access
- 50074/50076 — MFA required or failed
- 7000215 — Invalid client secret / token
Click Download (top toolbar) to export as CSV for the incident record.

Part 3 — Correlate and act

Overlay the service health incident timeline with the sign-in failure timestamps. If failures cluster inside a Microsoft incident window, mark those tickets as "resolved — Microsoft service issue".
For users whose failures fall outside any Microsoft incident, open each user in Entra → Users → [user] → Sign-in logs and drive to root cause (password reset, revoke sessions, review CA policy).

Graph API: Pull service health and sign-in failures

1. Active and resolved service health issues

GET https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/issues
?$filter=service in ('Exchange Online','SharePoint Online','OneDrive for Business')
&$orderby=startDateTime desc

Response (trimmed):

{
  "value": [
    {
      "id": "EX123456",
      "title": "Users may be unable to sync mailbox content",
      "service": "Exchange Online",
      "classification": "incident",
      "status": "serviceRestored",
      "startDateTime": "2026-02-14T08:12:00Z",
      "endDateTime": "2026-02-14T14:47:00Z",
      "impactDescription": "Subset of users experienced failures syncing..."
    }
  ]
}

2. Sign-in failures during the incident window

Build filters incrementally. The Graph $filter parser rejects many compound expressions — filter server-side by date/error, then filter app name client-side.

GET https://graph.microsoft.com/v1.0/auditLogs/signIns
?$filter=createdDateTime ge 2026-02-14T00:00:00Z and createdDateTime le 2026-02-15T23:59:59Z and status/errorCode ne 0
&$top=200
&$orderby=createdDateTime desc

Then in your client code, filter appDisplayName for sync clients:

const syncApps = ["OneDrive", "Outlook", "SharePoint Online", "OneNote"];
const matches = response.value.filter(s =>
  syncApps.some(app => (s.appDisplayName || "").includes(app))
);

3. Common error codes to group by

Error code	Meaning	Remediation
50126	Invalid credentials	Reset password, guide user to re-sign-in
50055	Password expired	Force change at next sign-in
53003	Conditional Access blocked	Review policy, check device compliance
50074	MFA required	User must complete MFA challenge
7000215	Invalid client secret	App registration / token issue

4. Headers and pagination

Include Authorization: Bearer {token}. For sign-ins, follow @odata.nextLink on every response until exhausted — a busy tenant easily exceeds 1,000 entries across a weekend.

PowerShell: Run the full correlation from a single script

The script uses the Microsoft.Graph module (v2+). It connects with the minimum required scopes, pulls service health, pulls sign-in failures for the window, joins them by service/timestamp, and emits two CSVs plus a console summary.

Prerequisites

PowerShell 7+ recommended
Install-Module Microsoft.Graph -Scope CurrentUser
Account with Global Reader or Service Support Administrator plus Reports Reader
Entra ID P1 for sign-in log access

Usage

# Review the last weekend (auto-detected)
.\Review-M365SyncFailures.ps1

# Review a specific window
.\Review-M365SyncFailures.ps1 -StartDate '2026-02-14T00:00:00Z' -EndDate '2026-02-15T23:59:59Z'

# Specify output folder
.\Review-M365SyncFailures.ps1 -OutputPath 'C:\Reports\SyncIncident'

What the script does

Connects to Graph with ServiceHealth.Read.All, AuditLog.Read.All, Directory.Read.All.
Auto-calculates the most recent Saturday 00:00 → Sunday 23:59 if no date range is provided.
Calls /admin/serviceAnnouncement/issues and filters for Exchange, SharePoint, and OneDrive.
Calls /auditLogs/signIns with the date filter, paginates through every page, then filters client-side for sync app names.
Groups failures by error code and user, and prints a console summary.
Writes ServiceHealth.csv and SignInFailures.csv to the output folder.
Flags users whose failures fall outside any Microsoft incident window as requires admin action.

Next steps

More Troubleshooting & Diagnostics recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.