Technical Tip: Entra ID syncing failure in FortiClient EMS

[smaruvala]

Description	This article discusses syncing Entra ID with the FortiClient EMS.
Scope	FortiClient EMS v7.4.3
Solution	After the upgrade of the FortiClient EMS server to v7.4.3, the Entra ID is failing to sync with the error mentioned in the screenshot below: The error message is not completely shown in the FortiClient EMS GUI. To view the complete error message, the Administrator must take debug logs from the FortiClient EMS using the following steps: Go to EMS -> System Settings -> Log Settings -> Log level -> set to Debug -> Save. Perform a manual AD sync in EMS under Endpoints -> Manage Domains -> (select) -> Sync. On the EMS server, navigate to C:\Program Files (x86)\Fortinet\FortiClientEMS\logs, and open the latest addaemonworker_yyyy-mm-dd.log. The debug log will show an error mentioned below: 2025-04-21T23:59:07.388Z ERROR daemon/addaemon_service.go:161 Failed to handle event: Error on processing event DomainSyncUpdateReqEvent: failed to update database sync object tables: error update_domain_users: query on fcm_default Failed query: SELECT * FROM update_domain_users(@in_domain_id, @in_added, @in_updated, @in_deleted, @in_user_parents) Error: ERROR: value "-11644473600" is out of range for type integer (SQLSTATE 22003) To solve the issue, contact Fortinet Support to obtain a hotfix.