Authentication provider users synchronization alerting

Hello,

Thank you for reaching out to us regarding this matter. I understand that you do not want to be bothered by an account that is already disabled because you already know the sync will fail. The only way to avoid this for now is to disable all heartbeat failures in your notification preferences. However, this also means that you could miss some important alerts. I know it is not the best solution for now.

In your situation, I understand you have a disabled account with your provider, and it is "normal" if it is not synchronized. Am I correct? Do you expect that account to be reenabled soon? I'm just curious to know why you have such an account in your PAM that you know will never be synced for a long period. We are looking to solve that issue, but please, let me know more about your context and why you get those alerts. We will see how we could improve our application to avoid unnecessary alerts.

Best regards,

Hi François,

In this case the person stopped working at our company. At the moment the employee has the last working day the acount will be automatically disabled and after a certain time period the account will be automatically deleted.

So this is normal behavior.

Hello,

Thank you for your answer. If my understanding is correct, the PAM account will be deleted only when the account is automatically deleted by the provider, am I right? Do you have automation that will delete the PAM account in DVLS, or will it be manual? Would it work for you if we send an alert only once and a new alert is sent again only if a sync is successful and fails again?

Best regards,

Hi François,

The "normal" Active Directory account will be deleted automatically, the PAM Active Directory account wil be manually deleted in Active Directory and DVLS (we have our own monitoring of these accounts within Active Directory).

Your sugestion will work for us!

Hi,

Can you give a statusupdate about this? We still have this problem.

Hello,

We have not worked on that yet, but I'm increasing the priority since I understand it can be annoying to receive all those emails. We will post back here once we have an update.

Best regards,

Hello,

Thank you for being so patient!

I am pleased to inform you that the issue has been resolved in the latest Devolutions server version (2025.3.10.0):
https://docs.devolutions.net/server/getting-started/installation/upgrade-server

We also recommend that you first perform the update in a staging/test environment:
https://docs.devolutions.net/server/kb/how-to-articles/create-server-staging-instance

Since this is resolved, I will mark this thread as resolved. If the problem persists, please let us know.

Best regards,

The problem is not solved, at least not in version 2026.1.16.0. Please solve this as soon as possible because this is very annoying.

Hello hjbos,

Thanks for the update, and sorry to hear you're still seeing this.

Here's the expected behavior: a notification is only sent when the system detects a transition in the account's sync heartbeat — i.e., when an account goes from "in sync" to "out of sync." Once an account is flagged as out of sync, subsequent checks are skipped and no new notification is sent, until the account goes back to "in sync" and then fails again — at which point a new notification is sent, since that's a new failure event.

Given this, if you're still receiving repeated alerts for the same account, it's likely its sync status is toggling between "in sync" and "out of sync" rather than staying consistently disabled — each toggle would legitimately trigger a new notification under this logic.

Could you confirm roughly how many notifications you've received and over what time window? We'll also dig into this further on our end. Thanks again for your patience.

Best regards,

Simon Leroux

Hi,

In about 4 days we received around 150 emails. Every hour 2 mails with the same info. The account was disabled the whole time. In Devolutions the account was still enabled. Today I manually disabled the account and the messages were gone. Guess the problem is the sync is not disabling the account?

Hi,

Thank you, that detail is very helpful. If the account stayed enabled in Devolutions while disabled on the provider side, it means the sync detected the disabled status but never applied it locally. Since our notification logic fires on an enabled→disabled transition, and the local status never actually flipped, each sync run treats it as a new transition — hence the repeated hourly emails.

This looks like a separate issue from the one we fixed previously: the disable action from the sync isn't being applied in Devolutions. We're looking into it. In the meantime, manually disabling the account (as you did) is the right workaround.

Could you confirm which authentication provider you're syncing with (AD, Entra ID, LDAP...)? That'll help us reproduce it.

Best regards,

Simon Leroux

Hi Simon,

We use Entra ID in this case.

Hi hjbos,

Thank you for this information, we will try to reproduce this behavior on our end.

Best regards,

Simon Leroux