Merge 2 Objects (1 from Azure cloud only tenant and 1 on-prem sync) for same user

Hello James Bowers,

Since you mentioned failure with both soft matching and hard matching strongly suggests a data conflict preventing the merge. Since the cloud account is critical, the solution lies in a specific, forced hard match process that overcomes potential conflicts, especially the missing Mail attribute and a possible ImmutableID block from a soft-deleted object.

The reason the initial hard match failed can be that the ImmutableID (the Base64-encoded on-premises objectGUID) is already held by a different, likely soft-deleted user object in the Azure AD Recycle Bin, causing a conflict.

will suggest you revised, comprehensive process focusing on resolving the underlying conflicts and executing a forced hard match.

1.Try to Resolve Prerequisites and Soft Match Issues

You mentioned the cloud user has a blank Mail attribute, which is a major reason soft matching fails (as soft matching relies on matching UserPrincipalName or ProxyAddresses/Mail).

Correct the Cloud User's Mail Attribute:

• This step removes an obstacle and aligns the accounts' data before forcing the match.
• Connect to Azure AD using the Microsoft Graph PowerShell SDK (or MSOL if you prefer, but Graph is current):

    # Install the module if necessary: Install-Module Microsoft.Graph -Scope CurrentUser
    Connect-MgGraph -Scopes "User.ReadWrite.All"
    # 1. Get the on-premises user's correct email address (UPN or primary SMTP)
    $TargetEmail = "******@yourdomain.com" 
    # 2. Update the cloud user's Mail attribute to match the on-prem value
    Update-MgUser -UserId "******@yourtenant.onmicrosoft.com" -Mail $TargetEmail
  

Verify No Admin Roles Exist on the Cloud User:

• A cloud-only user with an administrative role (like Global Admin, Exchange Admin, etc.) is prevented from being soft-matched by Azure AD Connect. While you are performing a hard match, it is best practice to remove this as a possible source of error.
• Temporarily remove the admin role from the cloud user if one exists.

2.Calculate and Force the Hard Match

This step calculates the required ImmutableID from the on-premises objectGUID and then uses the -Force parameter to assign it to the cloud user, which automatically resolves any conflicts with soft-deleted objects.

• Get the On-Premises User's objectGUID and Convert to Base64: Run this on the on-premises Domain Controller or a server with the AD module:

    # Replace 'userName' with the on-premises SamAccountName
    $OnPremUser = Get-ADUser -Identity "userName"
    $ImmutableID = [System.Convert]::ToBase64String($OnPremUser.ObjectGuid.ToByteArray())
    Write-Host "Target ImmutableID (Base64): $ImmutableID"
    # **Save this $ImmutableID value.**
  

• Force the ImmutableID Assignment: Connect to Azure AD using the MSOL module (the Graph SDK currently does not support the -Force parameter for ImmutableId):

    # Install the module if necessary: Install-Module MSOnline -Scope CurrentUser
    Connect-MsolService
    # Replace 'cloudUserPrincipalName' with the existing cloud account UPN
    $CloudUPN = "******@yourdomain.com" 
    # This command attempts to set the ID and WILL overwrite a soft-deleted conflict.
    Set-MsolUser -UserPrincipalName $CloudUPN -ImmutableId $ImmutableID -Force
  

  Note: The -Force parameter is critical here. If the initial hard match failed, it was almost certainly due to this ImmutableID being held by a soft-deleted object. The -Force switch permanently deletes the conflicting soft-deleted object, freeing the ID for assignment to the existing cloud user.

3.Then run the Synchronization Cycle:

Once the cloud user has the correct, forced ImmutableID, Azure AD Connect should see the perfect match and merge the objects.

• Execute a Full Synchronization: Run this command on the Azure AD Connect Server:

    Import-Module ADSync
    Start-ADSyncSyncCycle -PolicyType Initial
  

• Verify the Merge: Check the Synchronization Service Manager on the AAD Connect server for a successful Export to the Azure AD Connector. And, In the Azure AD portal (or using PowerShell), verify the cloud user's Source of Authority has changed from Azure AD to Windows Server AD.

Reference: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-feature-scheduler

Hope this helps! If you need more info, feel free to ask in the comments. Happy to help!

Regards,

Monalisha