AAD Sync fails with Authentication_MissingOrMalformed Access Token missing or malformed.

If you’ve recently performed a K2 migration to Microsoft Graph or installed a cumulative update, you might have noticed your Azure Active Directory (AAD) Sync suddenly failing.

The error log usually looks something like this: Error - {"odata.error":{"code":"Authentication_MissingOrMalformed", "message":{"lang":"en","value":"Access Token missing or malformed."}}}

This occurs because the Sync Service is still trying to communicate using legacy protocols rather than the newly required Microsoft Graph provider type. To fix this, you need to manually transition the Sync Engine's provider type and register the OAuth Resource ID.

The Fix: Transitioning AAD to Microsoft Graph

The following SQL script automates the transition by updating the SyncEngine tables to use the MSGraph provider type and mapping the correct oAuthResourceId from your Security Label configuration.

⚠️ Prerequisite: It is highly recommended to create a full backup of your K2 database before executing any scripts directly against the tables.

SQL

/* Nintex Automation (K2) AAD to Graph Sync Fix
   Note: This script assumes your Provider and Security Label names are 'AAD'.
   If your environment uses different names, update the 'WHERE Name = ...' clauses accordingly.
*/

DECLARE @ProviderTypeID AS int
SELECT @ProviderTypeID = ID
FROM [SyncEngine].[ProviderType]
WHERE Type = 'MSGraph'

-- Update the Provider to use the new Graph Type
UPDATE [SyncEngine].[Provider]
SET ProviderTypeID = @ProviderTypeID
WHERE Name = 'AAD'

DECLARE @ProviderInstanceID AS int
SELECT @ProviderInstanceID = ID
FROM [SyncEngine].[ProviderInstance]
WHERE ProviderID = (SELECT ID FROM [SyncEngine].[Provider] WHERE Name = 'AAD')

DECLARE @ProviderInstanceIDGuid AS nvarchar(max)

-- Extract the OAuth Resource ID from the Security Label AuthInit XML
SELECT @ProviderInstanceIDGuid = AuthInit.value('(/AuthInit/OAuthResourceID/node())[1]','nvarchar(max)')
FROM [HostServer].[SecurityLabel]
WHERE SecurityLabelName = 'AAD'

-- Register the Graph Resource ID in the SyncEngine Runtime Config
INSERT INTO [SyncEngine].[ProviderInstanceRuntimeConfig]([ProviderInstanceID],[ConfigKey],[ConfigValue])
VALUES (@ProviderInstanceID, 'msgraph.oAuthResourceId', @ProviderInstanceIDGuid)