Duplicate accounts appearing after syncing on-prem AD with Entra ID

Question

Duplicate accounts appearing after syncing on-prem AD with Entra ID

Vincent 0

I recently set up Entra Connect to sync our on-premises AD users with Microsoft Entra ID. After the initial sync, I noticed that a few users now have duplicate accounts one is synced from our local AD and the other is the original cloud-only account that already existed.

Both accounts share the same UPN and email address, but they’re treated as separate users in Entra ID. The cloud-only accounts already have licenses, mailboxes, and Teams access assigned, so I really don’t want to delete them and risk losing that data.

Is there a way to merge or link the on-prem synced user with the existing cloud user so it becomes a single identity? Or any safe method to handle this kind of conflict?

VEMULA SRISAI 1,970 Reputation points Microsoft External Staff Moderator

2025-11-13T03:45:51.8966667+00:00

Hello Vincent ,

Thank you for reaching out.

This behavior occurs when an existing cloud-only user in Microsoft Entra ID has the same UPN or email address as a new on-premises user being synced through Entra Connect. Because their immutable identifiers (sourceAnchor values) don’t match, Entra ID treats them as two separate accounts.

To safely merge these accounts without losing any mailbox, Teams, or license data, you’ll need to link the on-premises AD user to the existing cloud user by performing a “hard match” using the ImmutableID attribute.

Here are the recommended steps:

1.Connect to Microsoft Entra PowerShell (MSOnline module).

2.Retrieve the on-premises user’s ObjectGUID and convert it to a Base64 string:

[System.Convert]::ToBase64String((Get-ADUser username).ObjectGUID.ToByteArray())

3.Update the existing cloud user with that ImmutableID:

Set-MsolUser -UserPrincipalName ******@domain.com -ImmutableId "Base64String"

4.Run a delta sync on the Entra Connect server:

Start-ADSyncSyncCycle -PolicyType Delta

After the sync completes, Entra ID will recognize both objects as the same identity, and the user will appear as a synchronized account (Source = “Windows Server AD”) while retaining all existing licenses and data.

Please note do not delete the cloud account, as that would permanently remove associated mailbox and Teams data.

For your reference:https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-existing-tenant

Your answer

VEMULA SRISAI 1,970 Reputation points Microsoft External Staff Moderator

2025-11-13T03:45:51.8966667+00:00

Hello Vincent ,

Thank you for reaching out.

This behavior occurs when an existing cloud-only user in Microsoft Entra ID has the same UPN or email address as a new on-premises user being synced through Entra Connect. Because their immutable identifiers (sourceAnchor values) don’t match, Entra ID treats them as two separate accounts.

To safely merge these accounts without losing any mailbox, Teams, or license data, you’ll need to link the on-premises AD user to the existing cloud user by performing a “hard match” using the ImmutableID attribute.

Here are the recommended steps:

1.Connect to Microsoft Entra PowerShell (MSOnline module).

2.Retrieve the on-premises user’s ObjectGUID and convert it to a Base64 string:

[System.Convert]::ToBase64String((Get-ADUser username).ObjectGUID.ToByteArray())

3.Update the existing cloud user with that ImmutableID:

Set-MsolUser -UserPrincipalName ******@domain.com -ImmutableId "Base64String"

4.Run a delta sync on the Entra Connect server:

Start-ADSyncSyncCycle -PolicyType Delta

After the sync completes, Entra ID will recognize both objects as the same identity, and the user will appear as a synchronized account (Source = “Windows Server AD”) while retaining all existing licenses and data.

Please note do not delete the cloud account, as that would permanently remove associated mailbox and Teams data.

For your reference:https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-existing-tenant

Share via

Duplicate accounts appearing after syncing on-prem AD with Entra ID

Your answer