Interactive Troubleshooter

Published: Sep 27, 2026

Entra ID Sync Error: Duplicate Proxy Address

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

Systematically diagnose and resolve Microsoft Entra Connect (formerly Azure AD Connect) provisioning failures caused by duplicate proxyAddresses and UserPrincipalName conflicts. This guide provides actionable PowerShell commands, IdFix usage steps, and cloud object clearing procedures.

Full Diagnostic Tree & Step-by-Step Overview

Where is the duplicate proxy address conflict currently originating or manifesting in your environment?

The conflict is between two active On-Premises Active Directory objects (Users, Contacts, or Groups).
The conflict is between an On-Premises Active Directory object and a Cloud-Only Entra ID object.
The conflict is caused by a Soft-Deleted (Recycle Bin) user in Entra ID holding the proxy address.
The conflict occurs during cloud object hard-matching or immutableId migration scenarios.

Which type of On-Premises Active Directory objects share the duplicate SMTP/proxy address?

Two active User objects have identical smtp/SMTP entries in their proxyAddresses attribute.
A User object conflicts with a Distribution List, Mail-Enabled Security Group, or Shared Mailbox.
A User object conflicts with an Active Directory Mail Contact or Remote Contact object.
Multiple legacy objects contain duplicate addresses across a multi-forest Active Directory environment.

Duplicate Proxy Address Between Active On-Premises User Objects

Solution:

Root Cause: On-Premises Active Directory Attribute Duplication

Microsoft Entra Connect enforces strict uniqueness for all addresses defined in the proxyAddresses multi-value string attribute and the mail attribute. When two distinct user objects in Active Directory contain the same email alias (e.g., smtp:john.doe@company.com), the Entra ID Sync engine flags an AttributeDuplicateAttribute error and halts synchronization for the conflicting object to prevent account hijacking or mail routing loops.

# Diagnostic Verification:

1. Open PowerShell on a Domain Controller or machine with Remote Server Administration Tools (RSAT).
2. Search for all AD objects containing the specific duplicate proxy address:

powershell
   Get-ADObject -Filter "proxyAddresses -like 'smtp:john.doe@company.com'" -Properties proxyAddresses, userPrincipalName

3. Review the returned Distinguished Names (DN) to confirm which two active user accounts contain matching strings.

# Step-by-Step Fix:

1. Identify the Authorized Owner:

Determine which user account legitimately requires the primary or secondary alias.

2. Remove the Duplicate Alias from the Secondary Account:

Open Active Directory Users and Computers (dsa.msc).

Ensure Advanced Features is enabled under the View menu.

Open the properties of the secondary user account > Navigate to Attribute Editor.

Double-click proxyAddresses, locate the conflicting smtp:alias@domain.com entry, and click Remove.

Click Apply and OK.

3. Force Delta Synchronization on the Entra Connect Server:

Log into your Microsoft Entra Connect server and open PowerShell as Administrator.

Execute a delta sync cycle:

powershell
     Start-ADSyncSyncCycle -PolicyType Delta

# Prevention & Long-Term Monitoring:

Run the official Microsoft IdFix Privacy and Remediation Tool periodically across your Active Directory forests to detect proxy address collisions before triggering sync cycles.

Proxy Address Conflict Between User and Group Object

Solution:

Root Cause: Cross-Class Attribute Collision (User vs. Distribution/Security Group)

Entra ID maintains a single flat global address list (GAL) namespace. If a newly created user account is assigned an smtp: proxy address that is already attached to an active Distribution Group, Mail-Enabled Security Group, or Microsoft 365 Group, Entra Connect rejects the user object synchronization step with an AttributeDuplicateAttribute exception.

# Diagnostic Verification:

1. Open PowerShell with the Active Directory module loaded.
2. Search across both user and group classes for the conflicting address:

powershell
   Get-ADObject -Filter "proxyAddresses -like 'smtp:sales@company.com'" -Properties objectClass, proxyAddresses

3. Verify if one of the returned objects is a group (objectClass : group).

# Step-by-Step Fix:

1. Modify the Group Proxy Address in Active Directory:

If the address belongs to a distribution group, open dsa.msc or Exchange Management Shell.

For AD PowerShell, remove the alias from the group:

powershell
     Set-ADGroup -Identity "SalesGroup" -Remove @{proxyAddresses="smtp:sales@company.com"}

2. Assign a Unique Alias to the Group:

Add a new unique proxy address to the group if mail delivery is still required:

powershell
     Set-ADGroup -Identity "SalesGroup" -Add @{proxyAddresses="smtp:sales-team@company.com"}

3. Trigger Sync Cycle:

Run Start-ADSyncSyncCycle -PolicyType Delta on your sync server to clear the provisioning error in Entra ID.

# Prevention & Long-Term Monitoring:

Establish strict naming conventions for distribution lists and shared resources to prevent administrators from assigning generic group aliases to individual staff accounts.

Proxy Address Conflict Involving Active Directory Mail Contacts

Solution:

Root Cause: Stale Mail Contact or Remote Contact Object Assignment

Mail Contacts (objectClass : contact) created in Exchange on-premises to route external emails often retain legacy targetAddress or proxyAddresses values. When an external contractor transitions to a full internal user account with a cloud mailbox, their existing Mail Contact blocks the new user's sync cycle.

# Diagnostic Verification:

1. Search Active Directory for Mail Contact objects matching the target proxy address:

powershell
   Get-ADObject -Filter "objectClass -eq 'contact' -and proxyAddresses -like 'smtp:vendor@company.com'" -Properties proxyAddresses, targetAddress

2. Check if the returned object is located in an OU configured within Entra Connect's sync scope.

# Step-by-Step Fix:

1. Delete or Modify the Stale Mail Contact:

If the contact is no longer required, delete it from Active Directory:

powershell
     Remove-ADObject -Identity "CN=VendorContact,OU=Contacts,DC=company,DC=com"

If the contact must be retained, remove the specific matching proxy address:

powershell
     Set-ADObject -Identity "CN=VendorContact,OU=Contacts,DC=company,DC=com" -Remove @{proxyAddresses="smtp:vendor@company.com"}

2. Trigger Delta Sync:

Execute Start-ADSyncSyncCycle -PolicyType Delta on the Entra Connect server.

# Prevention & Long-Term Monitoring:

Implement a decommissioning script for external contact objects whenever a new internal employee onboard request is processed.

Multi-Forest Duplicate Proxy Address Collisions

Solution:

Root Cause: Cross-Forest Schema Attribute Collision in Multi-Forest Deployments

In environments with multiple Active Directory forests connected to a single Entra ID tenant via Entra Connect, identical proxy addresses can exist across disparate forest boundaries (e.g., forestA.local and forestB.local). Entra Connect cannot merge these objects unless explicit join rules (such as msDS-ConsistencyGuid or matching mail attributes) are configured.

# Diagnostic Verification:

1. Run the Microsoft IdFix tool across all connected forests.
2. Open Synchronization Service Manager on the Entra Connect server (C:\Program Files\Microsoft Azure AD Sync\UIShell\miisclient.exe).
3. Click Operations > Select the latest failed sync run > Click AttributeDuplicateAttribute under sync errors to view the conflicting Global Unique Identifiers (GUIDs) from both forest management agents.

# Step-by-Step Fix:

1. Launch Microsoft IdFix:

Execute IdFix.exe on a domain-joined machine with enterprise read permissions.

Click Query to scan all connected forests.

2. Resolve Duplicates in IdFix GUI:

Filter by ERROR column = Duplicate.

In the UPDATE column, edit or clear the conflicting proxyAddress value.

Click Apply to execute automated Active Directory attribute remediation across the forest infrastructure.

3. Force Full Synchronization Cycle:

powershell
   Start-ADSyncSyncCycle -PolicyType Initial

# Prevention & Long-Term Monitoring:

Enforce centralized GalSync or identity management workflows when operating multi-forest hybrid environments.

What is the nature of the conflict between the On-Premises AD object and the Cloud-Only object?

A Cloud-Only user was created manually in M365/Entra ID with an address now assigned to an On-Premises user.
A Cloud-Only Group or Shared Mailbox in Exchange Online holds the required proxy address.
An external Entra ID Guest account (B2B) uses a proxy address matching an internal On-Premises user.
The cloud object was created by an automated provisioning tool (e.g., HR cloud sync) and blocks AD sync.

Conflict with Manually Created Cloud-Only Entra ID User Account

Solution:

Root Cause: Cloud-Only vs. On-Premises Attribute Collision

When a cloud-only user account is created directly in the Microsoft 365 Admin Center or Entra ID portal, it is assigned a cloud-managed proxyAddresses array. If an administrator later creates an on-premises Active Directory user with the same email alias and attempts to sync it, Entra Connect fails because cloud-only objects take precedence and block auto-matching if immutable keys do not line up.

# Diagnostic Verification:

1. Connect to Microsoft Graph PowerShell SDK:

powershell
   Connect-MgGraph -Scopes "User.ReadWrite.All"

2. Query Entra ID for the object possessing the conflicting proxy address:

powershell
   Get-MgUser -Filter "proxyAddresses/any(c:c eq 'smtp:user@company.com')" | Select-Object Id, DisplayName, UserPrincipalName, OnPremisesSyncEnabled

3. Confirm OnPremisesSyncEnabled is empty/false, verifying the object is Cloud-Only.

# Step-by-Step Fix:

1. Option A: Match Cloud Account to On-Premises Account (Soft-Match):

Ensure the On-Premises AD user's UserPrincipalName or primary mail attribute matches the Cloud-Only user's UserPrincipalName exactly.

Enable Soft-Matching in Entra Connect if disabled, then trigger a sync:

powershell
     Start-ADSyncSyncCycle -PolicyType Delta

2. Option B: Remove Conflicting Proxy Address from Cloud Account:

If the cloud-only user is a separate entity, remove the proxy address using Microsoft Graph:

powershell
     Update-MgUser -UserId "<Cloud-User-Object-ID>" -ProxyAddresses @("SMTP:user-cloud@company.com")

3. Re-sync On-Premises Object:

Force delta sync on the Entra Connect server to allow the on-premises user to sync cleanly.

# Prevention & Long-Term Monitoring:

Provision all user accounts exclusively in On-Premises Active Directory if they fall within synced Organizational Units (OUs).

Conflict with Cloud-Only M365 Group or Shared Mailbox

Solution:

Root Cause: Exchange Online Cloud Resource Proxy Reservation

Shared mailboxes or Microsoft 365 Groups created directly within Exchange Online reserve their primary and alias SMTP addresses in the tenant's Exchange Directory. If an on-premises object syncs an identical proxy address, Entra Connect encounters an AttributeDuplicateAttribute error during the export phase.

# Diagnostic Verification:

1. Connect to Exchange Online PowerShell:

powershell
   Connect-ExchangeOnline

2. Query all Exchange Online recipient types for the duplicate address:

powershell
   Get-Recipient -ResultSize Unlimited | Where-Object {$_.EmailAddresses -like "*user@company.com*"} | Select-Object Name, RecipientType, EmailAddresses

# Step-by-Step Fix:

1. Remove the Duplicate Alias in Exchange Online:

If the cloud resource is a Shared Mailbox or Group, remove the conflicting alias:

powershell
     Set-Mailbox -Identity "CloudSharedMailbox" -EmailAddresses @{remove="user@company.com"}

If the resource is a Microsoft 365 Group:

powershell
     Set-UnifiedGroup -Identity "CloudGroup" -EmailAddresses @{remove="user@company.com"}

2. Run Entra Connect Sync:

On the sync server, run:

powershell
     Start-ADSyncSyncCycle -PolicyType Delta

# Prevention & Long-Term Monitoring:

Perform Exchange Online recipient checks before assigning new email aliases to on-premises Active Directory accounts.

Proxy Address Conflict with Entra ID B2B Guest Account

Solution:

Root Cause: External Guest User Account Proxy Matching Failure

When external guests are invited to collaborate in Entra ID, an object of type Guest is created. If the guest's Mail or otherMails attribute matches an smtp: entry being synced from an internal on-premises Active Directory account, Entra ID blocks the sync to prevent account collision.

# Diagnostic Verification:

1. Connect to Microsoft Graph PowerShell:

powershell
   Connect-MgGraph -Scopes "User.Read.All"

2. Search for guest accounts matching the proxy address:

powershell
   Get-MgUser -Filter "userType eq 'Guest'" -All | Where-Object {$_.Mail -eq "external.user@company.com" -or $_.OtherMails -contains "external.user@company.com"}

# Step-by-Step Fix:

1. Remove or Update the Guest Account Email:

If the guest account is no longer needed, delete the guest user in Entra Admin Center.

If the guest account must be kept, clear its conflicting otherMails property via PowerShell:

powershell
     Update-MgUser -UserId "<Guest-Object-ID>" -OtherMails @()

2. Trigger Delta Sync:

powershell
   Start-ADSyncSyncCycle -PolicyType Delta

# Prevention & Long-Term Monitoring:

Use dedicated external domain formats or tenant invitation controls to prevent guests from using internal corporate domain aliases.

HR Cloud Automated Provisioning Conflict

Solution:

Root Cause: Race Condition between HR Cloud Inbound Provisioning and Entra Connect

Automated HR provisioning tools (e.g., Workday or SuccessFactors to Entra ID/AD integration) can write email attributes directly to Entra ID prior to on-premises AD synchronization, creating a state where both systems write identical proxy addresses simultaneously.

# Diagnostic Verification:

1. Check Entra ID Provisioning Logs in the Entra Admin Center (Identity > Monitoring & health > Provisioning logs).
2. Look for recent provisioning events matching the target user UPN to inspect written attributes.

# Step-by-Step Fix:

1. Pause HR Inbound Sync Job Temporarily:

In Entra Admin Center, navigate to your HR Provisioning App and click Pause provisioning.

2. Align On-Premises AD Attributes:

Ensure the on-premises AD object possesses the exact mail and proxyAddresses expected by the HR mapping rules.

3. Clear Duplicate Address in Cloud and Resume Sync:

Clear the cloud object's proxy entry via Graph PowerShell, run Start-ADSyncSyncCycle -PolicyType Delta, then click Restart provisioning in the HR application portal.

# Prevention & Long-Term Monitoring:

Configure HR Inbound Provisioning to write exclusively to On-Premises Active Directory first, allowing Entra Connect to handle all cloud attribute exports centrally.

In what cloud recycling or deletion state does the conflicting proxy address reside?

The conflicting user was deleted in Entra ID and resides in the Deleted Users (Recycle Bin) container.
An Exchange Online soft-deleted mailbox retains the proxy address lock.
A soft-deleted Microsoft 365 Group or Unified Group retains the proxy address.
The object was deleted on-premises, but the cloud deletion process is stuck or pending.

Soft-Deleted User Object in Entra ID Recycle Bin Blocking Sync

Solution:

Root Cause: Entra ID Deleted Users Container Proxy Retention

When a user is deleted from Entra ID (or moved out of Entra Connect sync scope on-premises), the cloud object enters a Soft-Deleted state in the Entra ID Recycle Bin for 30 days. During this 30-day window, the soft-deleted object retains all its original proxyAddresses and UserPrincipalName values to allow restoration, blocking new on-premises objects from syncing matching aliases.

# Diagnostic Verification:

1. Connect to Microsoft Graph PowerShell SDK:

powershell
   Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All"

2. Search the Directory Recycle Bin for deleted users holding the proxy address:

powershell
   Get-MgDirectoryDeletedItemAsUser -All | Where-Object {$_.ProxyAddresses -contains "smtp:user@company.com"}

# Step-by-Step Fix:

1. Hard-Delete (Permanently Purge) the Soft-Deleted User from Entra ID:

Execute the purge command using the deleted user's Object ID:

powershell
     Remove-MgDirectoryDeletedItem -DirectoryObjectId "<Deleted-User-Object-ID>"

2. Verify Deletion from Recycle Bin:

Confirm the item no longer returns in the deleted items query.

3. Force Delta Synchronization:

On your Entra Connect server, run:

powershell
     Start-ADSyncSyncCycle -PolicyType Delta

# Prevention & Long-Term Monitoring:

When re-creating user accounts on-premises, always permanently purge corresponding legacy soft-deleted cloud accounts prior to running sync cycles.

Soft-Deleted Exchange Online Mailbox Retaining Proxy Address

Solution:

Root Cause: Exchange Online Soft-Deleted Mailbox Reservation

When a cloud mailbox is deleted or unassigned a license, Exchange Online moves the mailbox into a SoftDeletedMailbox state for 30 days (or longer if litigation hold is enabled). The Exchange directory holds the EmailAddresses assigned to that soft-deleted mailbox, preventing new objects from utilizing them.

# Diagnostic Verification:

1. Connect to Exchange Online PowerShell:

powershell
   Connect-ExchangeOnline

2. Search for soft-deleted mailboxes holding the conflicting address:

powershell
   Get-SoftDeletedMailbox | Where-Object {$_.EmailAddresses -like "*user@company.com*"} | Select-Object Name, Guid, LitHoldEnabled

# Step-by-Step Fix:

1. Check Litigation Hold Status:

If LitHoldEnabled is True, you cannot purge the mailbox without removing the hold or inactive mailbox status first.

2. Permanently Remove Soft-Deleted Mailbox (If Litigation Hold is False):

powershell
   Remove-SoftDeletedMailbox -Identity "<Mailbox-Guid>" -PermanentlyDelete

3. Clear Proxy Address from Soft-Deleted Mailbox (If Hold must remain):

If the mailbox must be preserved for compliance, remove only the conflicting alias:

powershell
     Set-Mailbox -Identity "<Mailbox-Guid>" -RemoveInactiveMailbox -EmailAddresses @{remove="user@company.com"}

4. Force Sync Cycle on Entra Connect Server:

powershell
   Start-ADSyncSyncCycle -PolicyType Delta

# Prevention & Long-Term Monitoring:

Refer to official Microsoft Entra Connect Sync Error Documentation for detailed guidance on handling duplicate attribute errors.

Soft-Deleted Microsoft 365 Group Retaining Proxy Address

Solution:

Root Cause: Unified Group Recycle Bin Reservation

Deleted Microsoft 365 Groups (Unified Groups) remain in a soft-deleted state for 30 days. All associated proxy addresses (including primary group SMTP and SharePoint/Teams aliases) remain locked in the tenant directory until the group is hard-deleted.

# Diagnostic Verification:

1. Connect to Microsoft Graph PowerShell:

powershell
   Connect-MgGraph -Scopes "Group.ReadWrite.All", "Directory.ReadWrite.All"

2. Search soft-deleted groups for the proxy address:

powershell
   Get-MgDirectoryDeletedItemAsGroup -All | Where-Object {$_.ProxyAddresses -contains "smtp:group@company.com"}

# Step-by-Step Fix:

1. Permanently Purge the Deleted Group:

powershell
   Remove-MgDirectoryDeletedItem -DirectoryObjectId "<Deleted-Group-Object-ID>"

2. Trigger Delta Sync:

powershell
   Start-ADSyncSyncCycle -PolicyType Delta

# Prevention & Long-Term Monitoring:

Maintain an administrative inventory of deleted groups when recycling email aliases for new projects or users.

Stuck Synchronization Deletion Pipeline (DirSync Export Delay)

Solution:

Root Cause: Entra Connect Export Connector Queue Block

An object deleted in on-premises Active Directory may become stuck in the Entra Connect Connector Space (CS) pending export queue due to previous sync errors, preventing the deletion signal from reaching Entra ID.

# Diagnostic Verification:

1. Open Synchronization Service Manager (miisclient.exe).
2. Select Connectors > Right-click the Microsoft Entra ID Connector > Search Connector Space.
3. Filter by Pending Export and check for uncommitted Delete operations.

# Step-by-Step Fix:

1. Force Full Sync Cycle to Flush Export Queue:

powershell
   Start-ADSyncSyncCycle -PolicyType Initial

2. Re-evaluate Sync Errors in Sync Service Manager:

If an object remains stuck, stop the sync service:

powershell
     Stop-Service ADSync

Restart the ADSync service to clear memory locks:

powershell
     Start-Service ADSync

3. Re-run Delta Sync:

powershell
   Start-ADSyncSyncCycle -PolicyType Delta

# Prevention & Long-Term Monitoring:

Regularly inspect the Synchronization Service Manager operations log for uncommitted pending exports.

What specific hard-matching or immutable ID issue is preventing successful proxy address sync?

Hard-Matching via SourceAnchor (msDS-ConsistencyGuid) fails due to mismatched cloud immutableId.
Soft-Matching via SMTP/UPN is blocked because Duplicate Attribute Resiliency is enabled.
An object was restored from AD Recycle Bin and generated a new objectGUID/SourceAnchor.
Tenant was migrated from legacy ObjectGUID matching to msDS-ConsistencyGuid, causing orphan matches.

Mismatched Cloud ImmutableId during Hard-Match Attempt

Solution:

Root Cause: ImmutableId / SourceAnchor Mismatch on Cloud Object

When attempting to link an on-premises Active Directory account to an existing cloud-only user, Entra Connect compares the calculated SourceAnchor (usually Base64-encoded msDS-ConsistencyGuid or objectGUID) against the cloud object's ImmutableId. If the cloud object already possesses a non-null, mismatched ImmutableId, Entra Connect rejects the merge and throws a duplicate proxy address error.

# Diagnostic Verification:

1. Get On-Premises User objectGUID in Base64 format:

powershell
   $guid = (Get-ADUser -Identity "john.doe").objectGUID
   $base64Guid = [Convert]::ToBase64String($guid.ToByteArray())
   Write-Output $base64Guid

2. Query Cloud User ImmutableId using Graph PowerShell:

powershell
   Get-MgUser -UserId "john.doe@company.com" | Select-Object UserPrincipalName, OnPremisesImmutableId

3. Compare $base64Guid with OnPremisesImmutableId. If they do not match, hard-matching fails.

# Step-by-Step Fix:

1. Clear Mismatched ImmutableId on Cloud User:

powershell
   Update-MgUser -UserId "john.doe@company.com" -OnPremisesImmutableId $null

2. Set Exact Base64 SourceAnchor on Cloud User:

powershell
   Update-MgUser -UserId "john.doe@company.com" -OnPremisesImmutableId $base64Guid

3. Trigger Delta Sync:

powershell
   Start-ADSyncSyncCycle -PolicyType Delta

# Prevention & Long-Term Monitoring:

Ensure all manual cloud-matching procedures use precise Base64 conversion strings for msDS-ConsistencyGuid or objectGUID.

Duplicate Attribute Resiliency (Quarantine) Masking Address Resolution

Solution:

Root Cause: Entra ID Duplicate Attribute Resiliency Feature Isolation

When Duplicate Attribute Resiliency is active in an Entra ID tenant, sync conflicts do not completely block object creation. Instead, Entra ID creates the user object but strips or rewrites the conflicting proxy address (e.g., changing user@company.com to user@company.onmicrosoft.com or adding a random string), quarantining the attribute in cloud storage.

# Diagnostic Verification:

1. Connect to Microsoft Graph PowerShell:

powershell
   Connect-MgGraph -Scopes "Directory.ReadWrite.All"

2. Query dirSyncError objects in the tenant:

powershell
   Get-MgUser -Filter "onPremisesProvisioningErrors/any()" | Select-Object DisplayName, UserPrincipalName, OnPremisesProvisioningErrors

# Step-by-Step Fix:

1. Inspect Quarantined Attribute Details:

Review the OnPremisesProvisioningErrors property to find the quarantined ProxyAddress value and conflicting object ID.

2. Fix Conflict at On-Premises AD Source:

Remove or update the conflicting proxy address on the source AD object identified in the error payload.

3. Force Sync and Clear Quarantine:

Run delta sync on your Entra Connect server:

powershell
     Start-ADSyncSyncCycle -PolicyType Delta

Entra ID will automatically remove the quarantine flag and restore the original proxy address to the object.

# Prevention & Long-Term Monitoring:

Monitor the Sync Errors tab in the Entra Admin Center regularly to clear quarantined attributes before they impact mail delivery.

Restored Active Directory User Object Generating New SourceAnchor

Solution:

Root Cause: AD Recycle Bin Restoration SourceAnchor Desynchronization

When an Active Directory user is deleted and subsequently restored, or re-created manually with identical attributes, the object receives a new objectGUID. If the cloud object retains the old ImmutableId from the prior instance, Entra Connect sees a new object attempting to claim an existing proxy address, triggering a collision error.

# Diagnostic Verification:

1. Compare the restored AD user's current objectGUID against the cloud user's OnPremisesImmutableId.
2. Note the mismatch caused by object re-creation.

# Step-by-Step Fix:

1. Calculate New Base64 SourceAnchor from Restored AD Object:

powershell
   $newGuid = (Get-ADUser -Identity "RestoredUser").objectGUID
   $newBase64 = [Convert]::ToBase64String($newGuid.ToByteArray())

2. Update Cloud User ImmutableId with New Value:

powershell
   Update-MgUser -UserId "clouduser@company.com" -OnPremisesImmutableId $newBase64

3. Execute Delta Sync:

powershell
   Start-ADSyncSyncCycle -PolicyType Delta

# Prevention & Long-Term Monitoring:

Always restore objects directly via Active Directory Administrative Center (ADAC) Recycle Bin rather than manually re-creating user accounts with identical names.

SourceAnchor Migration Inconsistency (ObjectGUID to msDS-ConsistencyGuid)

Solution:

Root Cause: Partial SourceAnchor Rule Migration State

During Entra Connect upgrades or sourceAnchor rule changes from objectGUID to msDS-ConsistencyGuid, some user accounts on-premises may fail to have their msDS-ConsistencyGuid populated automatically by Entra Connect. The cloud object retains its old ImmutableId format, causing sync export operations to treat the objects as un-matched duplicates.

# Diagnostic Verification:

1. Check if msDS-ConsistencyGuid is null on the on-premises user:

powershell
   Get-ADUser -Identity "john.doe" -Properties msDS-ConsistencyGuid | Select-Object Name, msDS-ConsistencyGuid

2. Verify if Entra Connect configuration has SourceAnchor set to msDS-ConsistencyGuid.

# Step-by-Step Fix:

1. Manually Populate msDS-ConsistencyGuid with objectGUID Bytes on-premises:

powershell
   $user = Get-ADUser -Identity "john.doe"
   [byte[]]$guidBytes = $user.objectGUID.ToByteArray()
   Set-ADUser -Identity $user -Replace @{'msDS-ConsistencyGuid'=$guidBytes}

2. Run Entra Connect Delta Sync:

powershell
   Start-ADSyncSyncCycle -PolicyType Delta

# Prevention & Long-Term Monitoring:

Ensure the Entra Connect wizard completes the automatic msDS-ConsistencyGuid population step across all OUs during initial configuration or upgrade.

Related Diagnostic Guides

SharePoint Online Access Denied Even as Owner

Interactive: Game Crashes - Overheating, Driver, or Corrupted Files?

Intune Device Compliance Failed: Conditional Access Fix

Power Automate Flow Failed: Connector Timeout Diagnostic

Interactive: Blue Screen - Which Driver Caused It? Use Driver Verifier

Subscribe to StepDiag

Embed Guide on Your Website