How to Fix Azure AD Connect Users Not Synchronizing After Migration
Question details
Administrators need to resolve an issue where on-premises users fail to synchronize with Azure AD after a cutover migration due to duplicate or mismatched identity attributes.
- Product
- Azure AD Connect
- Device & OS
- not provided
- Scenario
- After completing a cutover migration, administrators find that some Exchange-created users remain unsynchronized and display their DirSync status as No.
- Observed behavior
- The Synchronization Service Manager reports errors such as AttributeValueMustBeUnique, usually indicating duplicate proxy addresses, UPNs, or SMTP values between on-premises and cloud identities.
Ensure you have global administrator access to your Microsoft 365 tenant and Enterprise Admin privileges on your on-premises Active Directory before attempting to modify synchronization attributes.
Identify and Resolve Duplicate Attributes using IDFix
Use the Microsoft IDFix tool to automatically query your on-premises Active Directory for duplicate or mismatched proxy addresses and UPNs.
The most common cause of the AttributeValueMustBeUnique error is a conflict where an on-premises user has an SMTP value or proxy address that is already assigned to a different cloud identity.
Download and launch the Microsoft IDFix DirSync Error Remediation Tool on a server joined to your on-premises domain.
Click 'Query' to scan your Active Directory. The tool will identify duplicate SMTP addresses and other format errors that prevent Azure AD Connect from synchronizing properly.
Review the Action column for objects with errors. Update the incorrect proxy addresses directly within the tool, select 'Edit', and click 'Apply' to commit the changes to Active Directory.
Open an elevated PowerShell prompt on your Azure AD Connect server and run 'Start-ADSyncSyncCycle -PolicyType Delta' to push the corrected attributes to the cloud.
Perform a Hard Match via ImmutableID
Manually link the on-premises user to the existing cloud identity by matching their ImmutableID when a soft match fails.
Simplify Your Business Document Workflows with WPS Office
While resolving complex Azure AD Connect synchronizations requires technical effort, choosing the right office productivity suite for your migrated users should be effortless. WPS Office is a robust, lightweight, and completely free alternative to Microsoft Office that guarantees seamless deployment and high user adoption.
- 1. Download WPS Office: Navigate to the official WPS Office website and click the free download button for your operating system.
- 2. Install the Software: Run the lightweight installer file to quickly set up the suite on your machine.
- 3. Start Creating: Open Writer, Spreadsheets, or Presentation to immediately begin working with complete Microsoft format compatibility.
Frequently Asked Questions
Why do I see the 'AttributeValueMustBeUnique' error in the Synchronization Service Manager?
This error occurs when an identity attribute, such as a primary SMTP address or User Principal Name (UPN), already exists on a different user object or contact within your Microsoft 365 cloud tenant, preventing Azure AD Connect from synchronizing the on-premises user.
What is the difference between a soft match and a hard match in Azure AD Connect?
A soft match relies on matching the user's UPN or primary SMTP address between on-premises Active Directory and the cloud. A hard match explicitly aligns the on-premises source anchor (like ms-DS-ConsistencyGuid) with the cloud user's ImmutableID, overriding any soft match conflicts.
How do I force a delta sync in Azure AD Connect to test my fixes?
You can initiate a delta synchronization by opening an elevated PowerShell window on your Azure AD Connect server and running the command: Start-ADSyncSyncCycle -PolicyType Delta.
