Duplicate Proxy Address Attribute and Authentication Issues with Microsoft_Azure_ADHybridHealth Extension in Azure AD Sync

Question

The issue was identified by Microsoft Entra Health, which flagged a duplicate ProxyAddresses error (SMTP:******@domain.au) caused by conflicting objects in on-premises Active Directory and Microsoft Entra ID.

The suggested fix from Entra Health is to update the Source Anchor value, but when attempting to apply this solution, I encountered authentication issues due to missing resource access for the Microsoft_Azure_ADHybridHealth extension.

This resulted in the fix failing and the issue still showing.

Thanks

Answer 1

Hello Marc Metzger,

Thank you for reporting the issue involving a duplicate ProxyAddresses attribute and authentication problems with the Microsoft_Azure_ADHybridHealth extension during Azure AD Sync.

Recommendation Actions:

1. Resolve Extension Resource Access Issue

• Visit: https://aka.ms/portalfx/resourceaccess 1
• Ensure that the extension Microsoft_Azure_ADHybridHealth has defined access to the required resource (self) in the portal configuration.
• You may need to:

• Reinstall the Entra Connect Health agent using a Global Administrator account.
• Confirm that .NET Framework 4.6.2 or later is installed.
• Check outbound connectivity to Azure service endpoints.

Reference: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-ports#table-7a---ports-and-protocols-for-microsoft-entra-connect-health-agent-for-ad-fssync-and-microsoft-entra-id

2. Update Source Anchor Safely

Once the extension issue is resolved:

• Use the Entra Connect Health Troubleshooter to update the Source Anchor. Please change the proxy address to a unique proxy address and ensure there is no conflict with other users + Run a delta sync
• Ensure that the object in on-prem AD is correctly matched to the cloud object to avoid further sync errors.

3. Monitor Sync Errors

• Go to Microsoft Entra ID > Connect > Connect Sync > Entra Connect Health > Sync Errors.
• Filter by Duplicate Attributes and check the Diagnose Status to confirm if the issue is resolved

Kindly let me know if this work for you and please let me know if you have any further questions.

If I have answered your question, please accept this answer as a token of appreciation and don't forget to give a thumbs up for "Was it helpful"!

Best regards,

Answer 2

Hi @Marc Metzger,

Based on your query, I understand that you would like to fix the duplicate attribute issue and encountered different issue while performing it.

To diagnose the issue, you can follow this document: Diagnose and remediate duplicated attribute sync errors.

As you have already found the issue is with duplicate attribute, you can go through this document: Duplicate or invalid attributes prevent directory synchronization in Microsoft 365.

By using the above document, you can find what are the user account that have the same proxy address in on-premises, and you can remove one of it to make sure there is no conflict. You can search in AD using the same proxy address and check the status, else go through the commands and information provided in the document. There is no requirement of changing the source anchor value for this if you could find the conflicting user account on the issue.

Regarding "Missing resource ``access for the Microsoft_Azure_ADHybridHealth extension", I would recommend you update the Entra connect, which might fix the issue. We have seen such error back in January and the issue got solved once users have upgraded to newer version.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment"