Fixing Office 365 Azure AD Sync issues

Symptoms:

You have synced the AD users, but you have duplicates or two of a similar user (reception@ and receptionist@). You try to edit the UPN of either user and you receive an error saying that the attribute must be unique.

On the sync service you get an error saying the attribute(usually the UPN) must be unique.

Background:

UPN = username (and usually email address)

ImmutableID (anchor) = used to link an AD user to an Office 365 user (after UPN matching)

In AD there exists an account with a UPN: mailbox1@example.com

In Office 365 there exists an account with a UPN: mail1@example.com

These two accounts are the same user, but their O365 email address does not match up with their UPN (not usually a problem, but during the initial sync it is)

The problem:

The AD sync service is started and AD users are synced with Office 365 users.

You log into Office 365 and see two users now: mailbox1@example.com(unlicensed) and mail1@example.com(licensed)

You try to un-sync mailbox1@example.com and change the UPN of mail1, but the next time you run the sync you get an "attribute must be unique" error or you get a duplicate again.

What happened?

When you synced the AD user mailbox1@example.com AD sync did not find a user "mailbox1@example.com" in Office 365 so it created a new user. When you un-sync the user it is moved to the Azure recycle bin so it still exists. You will be able to set the UPN of mail1@example.com to mailbox1@example.com, but the sync will still not work because there already exists an O365 user anchored to mailbox1@example.com.

Resolution

Symptoms:

  • You are seeing two Office 365 accounts for the same user (mail1@ex.com and mailbox1@ex.com), one is "Online only" and the other is "Synced with Active Directory"
    • It could also be like the screenshot below where one of them has a .onmicrosoft.com email
  • Only mail1@ex.com should exist

The Goal:

  • Delete the "synced with Active Directory"(mailbox1@ex.com) account and hard match the AD account with the one in 365 (mail1@ex.com) which presumably has all the mail data.

Prerequisites:

  • Computer with Powershell 5.0+ and the Active Directory RSAT tools (doesn't have to be your domain controller)
  • Access to the computer with Azure AD Connect installed
Follow the following steps exactly. Do not skip around. 

  1. Un Sync the AD user
    1. Move the problem user to an OU that is not being synced with Azure (you will need to modify your config if you are syncing all OUs)
    2. Run an Azure Sync Cycle
      1. Start-ADSyncSyncCycle
    3. The user should now show up as deleted on Office 365

  2. Install the MSOL powershell module
    1. Install-Module MSOnline
    2. Import-module MSOnline
  3. Permanently delete the problem user from 365
    1. Connect-MsolService
    2. Get-MsolUser -UserPrincipalName mailbox1@ex.com -ReturnDeletedUsers | Remove-MSOLUser -RemoveFromRecycleBin
    3. The user should disappear from 365 within the next few minutes
  4. Manually Match the AD user with the 365 user
    1. Run this script
    2. The unique ID of the two users will now match (you won't see this anywhere in the UI)
  5. Sync the AD user again
    1. Move the user back into a synced OU and run another sync cycle
    2. Start-ADSyncSyncCycle
  6. Almost done
    1. At this point you should see a single user on 365 that shows up as "Synced with Active Directory" with a UPN of mailbox1@ex.com
  7. Fixing the UPN
    1. You may notice that the UPN of the mailbox is the same as the one in AD; if this is your intention then you are done.
    2. However, if your user's email address and AD username don't match then you will need to change the UPN of the 365 account.
      1. Set-MsolUserPrincipalName -UserPrincipalName mailbox1@ex.com  -NewUserPrincipalName mail1@ex.com

Comments

Popular posts from this blog

FSLogix Troubleshooting guide

Best Practices for Deploying User Profile Disks

Removing Application UAC Requirements with Shims