How to Resolve Duplicate Users After Azure AD Connect Synchronization
Question details
The user needs to resolve duplicate Microsoft 365 accounts that were created due to a mismatch between on-premises Active Directory and existing cloud accounts during an Azure AD Connect synchronization.
- Product
- Microsoft 365 / Azure AD Connect
- Device & OS
- not provided
- Scenario
- Synchronizing on-premises Active Directory with Microsoft 365 cloud using Azure AD Connect.
- Observed behavior
- Azure AD Connect creates duplicate user accounts instead of merging them with existing cloud accounts, causing SMTP matching to fail because the email address is already assigned to the cloud object.
Ensure you have global administrator or hybrid identity administrator privileges in Microsoft 365 and access to your on-premises Active Directory server before modifying user synchronization attributes.
Match Accounts via Non-Synchronizing OU and Delta Sync
Safely remove the duplicate cloud account and correctly link the on-premises user to the existing cloud account using a non-syncing OU and manual synchronization adjustments.
This method ensures that the on-premises Active Directory account correctly maps to the intended Microsoft 365 cloud account without losing the original cloud mailbox data. You must accurately identify which account is the original cloud account and which is the duplicate before proceeding.
Go to the Microsoft 365 admin center and determine which user account is cloud-only (the original active account) and which is synchronized from on-premises (the newly created duplicate).
On your domain controller, temporarily move the on-premises AD user to an Organizational Unit (OU) that is not configured to synchronize with Azure AD Connect.
Open PowerShell on your Azure AD Connect server and run 'Start-ADSyncSyncCycle -PolicyType Delta' to force a sync. This action removes the synchronized duplicate account from the Microsoft 365 cloud.
If the duplicate cloud object remains in the deleted users container, permanently delete it to free up the SMTP addresses. Then, configure the appropriate ImmutableID (source anchor) on the correct cloud-only account to match the on-premises user.
Move the on-premises AD user back to the originally synchronized OU. Run another delta sync via PowerShell. Azure AD Connect will now successfully merge the on-premises user with the existing cloud account.
Manage Your Documents Locally with WPS Office
Dealing with complex cloud synchronization issues like Azure AD Connect duplicates can disrupt your workflow. While resolving your Microsoft 365 account errors, consider using WPS Office as a lightweight, powerful, and free alternative to Microsoft Office that works seamlessly offline and natively supports all your Office documents.
- 1. Download WPS Office: Visit the official WPS website and download the free installer for your operating system.
- 2. Install the Software: Run the installer and follow the quick setup instructions to configure WPS Office on your device.
- 3. Open Existing Office Files: Launch WPS Office to instantly view and edit your existing Word, Excel, and PowerPoint files without format loss.
Frequently Asked Questions
Why does Azure AD Connect create duplicate users instead of merging them?
This happens when the on-premises Active Directory account fails to 'soft match' (via SMTP or UPN) or 'hard match' (via ImmutableID) with the existing cloud account. When matching fails, Azure AD Connect provisions a completely new user object to avoid overwriting unrelated data.
How do I force a delta sync in Azure AD Connect?
Open PowerShell as an administrator on your Azure AD Connect server and execute the command 'Start-ADSyncSyncCycle -PolicyType Delta'. This forces the server to synchronize recent AD changes immediately.
What is an ImmutableID and why is it important?
The ImmutableID is a unique attribute used to permanently link an on-premises AD user to their corresponding cloud account in Microsoft 365. It ensures robust directory synchronization even if a user's name or email address changes.
Can I recover a deleted Microsoft 365 cloud account if I make a mistake?
Yes, deleted Microsoft 365 users are retained in the 'Deleted users' container for 30 days. They can be restored directly from the Microsoft 365 admin center, provided you have not permanently deleted them using PowerShell commands like Remove-MsolUser.
