Microsoft Account Errors

How to Fix Azure AD Immutable ID Mismatch with PowerShell

Khadija Khan Oct 21, 2026 868 views

Question details

The user needs to resolve an immutable ID mismatch between Microsoft Entra ID (Azure AD) and on-premises Active Directory prior to running synchronization.

How to Fix an Azure AD Immutable ID Mismatch with PowerShell

Product: Azure Active Directory / PowerShell
Device & OS: not provided
Scenario: Synchronizing on-premises Active Directory objects with cloud users using Azure AD Connect.
Observed behavior: An immutable ID mismatch occurs between the on-premises AD and the cloud AD environment, preventing user objects from correctly syncing across the hybrid identity infrastructure.

Before you start

Ensure you have global administrator or hybrid identity administrator privileges for both your on-premises Active Directory and Azure AD environments, and verify your organization's specific source-anchor configuration.

Solution 1Recommended

Update the Cloud User ImmutableId via PowerShell

Calculate the correct source anchor from your on-premises AD and manually update the cloud user's ImmutableId using PowerShell to force alignment.

When Azure AD Connect synchronizes an on-premises user to the cloud, it uses a matching source anchor, known as the ImmutableId. If these values fall out of sync, you must manually calculate the on-premises ID and apply it to the cloud identity via PowerShell before running the sync process again.

Verify On-Premises Object Anchor

Locate the correct on-premises Active Directory user object. Depending on your Azure AD Connect configuration, calculate its source anchor, which is typically the ObjectGUID converted into a Base64 string.

Connect to Azure AD

Launch PowerShell as an Administrator and execute the appropriate connection command, such as Connect-AzureAD, to securely authenticate to your Microsoft Entra ID cloud environment.

Update the Immutable ID

Run the Set-AzureADUser cmdlet to forcefully update the cloud user's ImmutableId parameter. Your command should look similar to: Set-AzureADUser -ObjectId user@domain.com -ImmutableId "<Calculated_Base64_String>".

Trigger a Delta Sync

Once the IDs match, execute a delta synchronization to apply the changes by running Start-ADSyncSyncCycle -PolicyType Delta on your Azure AD Connect sync server.

Consult Microsoft Hybrid Identity Guidance: Because specific PowerShell modules and source-anchor configurations vary widely across different tenants, it is highly recommended to reference official Microsoft Hybrid Identity documentation before making bulk modifications to your users.

Free Microsoft Office alternative

Manage Your Office Documents Effortlessly with WPS Office

While resolving advanced Microsoft Entra ID synchronization issues requires specialized PowerShell configurations, your daily document management shouldn't be difficult. WPS Office provides a lightweight, highly compatible alternative to Microsoft Office that is designed for frictionless productivity.

1. Download WPS Office: Navigate to the official WPS Office website to download the free installation package tailored for your operating system.
2. Install the Suite: Run the downloaded installer and follow the fast, straightforward on-screen instructions to set up the software.
3. Open Your Files: Launch WPS Office and directly open your existing Microsoft Office documents, spreadsheets, and presentations to continue your work instantly.

High format compatibility with Microsoft Word, Excel, and PowerPoint files.Lightweight software suite that installs quickly without complex cloud identity requirements.Completely free to use with an intuitive, familiar user interface for rapid migration.Built-in PDF editing tools, powerful templates, and robust offline capabilities.

microsoft office alternative - wps office

Frequently Asked Questions

What causes an Immutable ID mismatch in Azure AD?

An Immutable ID mismatch usually occurs when an on-premises Active Directory user is deleted and recreated, or when an existing cloud-only user is improperly matched to a new on-premises account. Consequently, the source anchor generated locally fails to align with the cloud account's existing identifier.

How do I calculate the Base64 Immutable ID for an Active Directory user?

If your environment uses the ObjectGUID as the source anchor, you can use a short PowerShell script to retrieve the ObjectGUID of the on-premises user account and convert it directly into a Base64 string, which serves as the exact Immutable ID required by Azure AD.

Can I clear an existing Immutable ID to fix sync errors?

Yes, if a user has been converted to cloud-only and you wish to hard-match them to a different on-premises object, you can clear their Immutable ID by setting it to a null value using the Set-AzureADUser cmdlet. This resets the anchor and allows a new sync match to occur.

Login & Account Issues