'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Resolve Duplicate Microsoft Entra ID and Local AD Accounts
Question details
Resolve synchronization conflicts between duplicate Microsoft Entra ID and local Active Directory accounts.
- Product
- Microsoft Entra ID / Active Directory
- Device & OS
- not provided
- Scenario
- Managing user directory synchronization and troubleshooting duplicate attribute errors.
- Observed behavior
- Synchronization conflicts occur due to matching UPN, mail, or proxy address attributes, resulting in duplicate or unlinked accounts.
Ensure you have administrative access to both your local Active Directory environment and the Microsoft Entra admin center. Verify which account was created first before modifying any directory attributes.
Resolve the Sync Conflict using PowerShell and Attribute Soft-Matching
Temporarily modify the local AD user's attributes to clear the sync conflict, then perform a soft-match to merge the accounts.
This method involves changing the local user's attributes so they are completely unique, which forces a clean directory synchronization and clears the conflict. Once the conflict clears, the correct values are restored to trigger a soft-match with the existing Entra ID account.
Open your local Active Directory environment. Temporarily change the local user's UPN, proxyAddresses, and mail attributes to unique temporary values to break the conflict.
Open PowerShell as an Administrator on your sync server and run the command: Start-ADSyncSyncCycle -PolicyType Delta to force a synchronization.
Wait for the synchronization to complete and verify in the Microsoft Entra admin center that the synchronization conflict for the user has been cleared.
Update the local AD user with the correct UPN and proxy addresses so they perfectly match the existing Microsoft Entra ID account.
Run the Start-ADSyncSyncCycle -PolicyType Delta command once more. The accounts should now successfully soft-match and link together.
Looking for a cost-effective office suite for your organization?
While you manage your organization's directory synchronization, consider providing your users with a powerful, lightweight, and cost-effective office solution. WPS Office offers an intuitive interface without the heavy licensing costs.
- 1. Download WPS Office: Visit the official WPS website and download the free installer for your operating system.
- 2. Install the Software: Run the installer and follow the quick on-screen prompts to set up the suite on your computer.
- 3. Open and Edit: Launch WPS Office and instantly open your existing Microsoft Office documents with perfect formatting preservation.
Frequently Asked Questions
What is a soft-match in Microsoft Entra Connect?
A soft-match occurs when Entra Connect automatically links an existing local Active Directory object with an existing cloud Microsoft Entra ID object based on matching attributes, primarily UserPrincipalName (UPN) or primary SMTP address.
Why do duplicate accounts get created during AD sync?
Duplicate accounts are typically created when synchronization rules fail to appropriately match an existing cloud account with a newly synced local account, often due to mismatched, missing, or conflicting UPN, mail, or proxyAddress attributes.
What does the Start-ADSyncSyncCycle command do?
This PowerShell command triggers the Microsoft Entra Connect sync engine to start a synchronization cycle immediately. Using the '-PolicyType Delta' parameter only syncs changes made since the last cycle, whereas '-PolicyType Initial' forces a complete, full sync of all objects.
How can I check the directory synchronization status?
You can check the sync status by logging into the Microsoft 365 Admin Center or the Microsoft Entra admin center and reviewing the directory sync status panel, which displays the last sync time and highlights any active synchronization attribute errors.
