Hello anonymous user,
Thanks for reaching out.
This is because Duplicate Attribute Resiliency feature in Azure Active Directory which will eliminate friction caused by UserPrincipalName and SMTP ProxyAddress conflicts when running one of Microsoft’s synchronization tools.
When Duplicate Attribute Resiliency feature disabled:
Lets say If there is an attempt to provision a new object with a UPN or ProxyAddress value that violates this uniqueness constraint, Azure Active Directory blocks that object from being created. Similarly, if an object is updated with a non-unique UPN or ProxyAddress, the update fails. The provisioning attempt or update is retried by the sync client upon each export cycle, and continues to fail until the conflict is resolved. An error report email is generated upon each attempt and an error is logged by the sync client.
When Duplicate Attribute Resiliency feature enabled:
Instead of completely failing to provision or update an object with a duplicate attribute, Azure Active Directory “quarantines” the duplicate attribute which would violate the uniqueness constraint.
If this attribute is required for provisioning, like UserPrincipalName, the service assigns a placeholder value. The format of these temporary values is
<OriginalPrefix>+<4DigitNumber>@<InitialTenantDomain>.onmicrosoft.com.
The attribute resiliency process handles only UPN and SMTP ProxyAddress values. Hope this helps.
To learn more see, Identity synchronization and duplicate attribute resiliency
------
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.