Fix Azure AD Connect Group Synchronization Conflicts After a Domain Change
Question details
Azure AD Connect fails to synchronize existing groups correctly after an on-premises domain change, often creating duplicate groups due to proxyAddresses or SMTP conflicts.
- Product
- Azure Active Directory Connect
- Device & OS
- not provided
- Scenario
- Synchronizing existing on-premises Active Directory groups to Azure AD after a domain migration without generating unwanted duplicate entries.
- Observed behavior
- Synchronization throws errors reporting conflicting SMTP attributes, and Azure AD Connect creates new cloud groups instead of matching the existing ones.
Ensure you have administrative credentials for both your on-premises Active Directory and Azure AD, and pause your Azure AD Connect sync cycle before modifying AD attributes.
Identify and Remove Duplicate proxyAddresses and SMTP Values
Clear conflicting SMTP addresses in your Active Directory to allow proper SMTP soft-matching of groups in Azure AD.
Even if an SMTP value appears unique in Azure AD, synchronization will fail to match the group if the value is duplicated anywhere within the local Active Directory.
Launch Active Directory Users and Computers (ADUC) on your domain controller and ensure Advanced Features are enabled under the View menu.
Search both the old and new Active Directory environments for duplicate proxyAddresses, paying close attention to uppercase SMTP addresses that designate the primary email.
Open the Properties of the conflicting objects, navigate to the Attribute Editor tab, and remove or update the conflicting SMTP values so they are globally unique.
Open PowerShell on your Azure AD Connect server and run 'Start-ADSyncSyncCycle -PolicyType Delta' to verify the synchronization conflict is resolved.
Restore the Correct Source Anchor (ImmutableID)
Fix matching issues caused when the source anchor of an existing group was altered during the domain change.
Manage Your IT Documentation Effectively with WPS Office
While resolving complex Microsoft directory synchronization issues requires deep Active Directory expertise, managing your IT deployment plans and migration documentation shouldn't be difficult. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office for writing procedures and analyzing network data.
- 1. Download the Installer: Visit the official WPS Office website and click the Free Download button.
- 2. Install the Software: Run the downloaded executable file and follow the standard on-screen instructions to complete the setup.
- 3. Document Your IT Procedures: Open WPS Writer or WPS Spreadsheet to begin creating detailed, perfectly formatted domain migration documents.
Frequently Asked Questions
Why does Azure AD Connect create duplicate groups instead of matching existing ones?
This occurs when the source anchor (ImmutableID) differs between the on-premises AD and Azure AD, or when conflicting duplicate SMTP addresses block a successful soft-match. Consequently, Azure AD Connect provisions an entirely new group in the cloud rather than merging them.
Can I change the source anchor for a group that is already synchronized to Azure AD?
Generally, no. The source anchor cannot be changed once an object is created and synchronized in Azure AD. If it is altered on-premises, Azure AD Connect will log a synchronization error until the original source anchor is restored.
How does SMTP matching work during directory synchronization?
SMTP matching, or soft-matching, connects an on-premises group to an existing Azure AD group by comparing their primary SMTP addresses. Both environments must have matching and globally unique proxyAddress values for the soft-match to be successful.
