adconnect onprem and cloud

Question

ew currently have a onprem ad and a cloud ad, we are synching the onprem contents with the cloud and running into a odd issue. we are removing certain users from the synching, by moving them into a non synced folder in local ad. then restoring the user in the cloud. this is being done to migrate users to cloud only ad. everything works but the local adconnect keeps trying to sync the user to the cloud. when we check the evet viewer, we get. full syncs were done after moving the users , as they disappeared from active users, and went into the deleted users. how do we stop these errors?

"This error indicates that a deleted object was recovered from the recycle bin in Azure AD before Azure AD Connect was able to confirm its deletion. Please delete the recovered object in Azure AD to fix this issue. Please refer to https://learn.microsoft.com/en-us/azure/active-directory/hybrid/tshoot-connect-sync-errors#deletion-access-violation-and-password-access-violation-errors

Tracking Id: bbac5dba-3288-47c1-912b-eaa89e4a6cde
ExtraErrorDetails:
[{"Key":"ObjectId","Value":["00d029a6-61d5-434f-8e04-6d1c499cfece"]}]"

Answer 1

Hi, see if this solution works for you:
https://learn.microsoft.com/en-us/answers/questions/703010/azure-ad-sync-error-114-1.html

Answer 2

@Darren Phillips
Thank you for your detailed post!

Error Message:
This error indicates that a deleted object was recovered from the recycle bin in Azure AD before Azure AD Connect was able to confirm its deletion. Please delete the recovered object in Azure AD to fix this issue. Please refer to https://learn.microsoft.com/en-us/azure/active-directory/hybrid/tshoot-connect-sync-errors#deletion-access-violation-and-password-access-violation-errors

Adding onto what was shared by @Andy David - MVP , and from your initial post - I understand that you're trying to remove certain users from being sync'd. You're removing these users by moving them into a non-sync'd folder within your local Active Directory, and once these users are deleted within Azure AD, you're then restoring the deleted users (within Azure) to migrate/convert these users to cloud only.

---------------------------

**Findings: **
From your error message and current migration process - converting users to cloud-only by restoring them from the Azure AD Deleted Users bin or clearing the ImmutableID is not supported. When you immediately restore the users within Azure AD - so they can become a cloud-only user, these user's will still contain all the on-prem properties that were synced from your local AD. For more info - Azure AD Sync error 114.

Sync error 114, which should be located within the Synchronization Service Manager (Export) logs, occurs because AADConnect soft deletes the user from Azure AD, and the user is immediately restored before AADConnect has a chance to confirm the delete.

-----------------------------

Troubleshooting:
Note: The only supported method for converting users is to disable DirSync on the Tenant. For more info - Deletion access violation and password access violation errors.

To resolve these errors, you'll have to delete the user(s) using PowerShell or the Azure Portal and run a delta sync so AADConnect can confirm the deletion.

1. Delete the Azure AD user via the Portal or with PowerShell so the user is in a soft deleted (restorable/recoverable) state.
2. Run Start-ADSyncSyncCyle -PolicyType Delta and it should import data appropriately.
3. Confirm the Deletion was successful.
4. Restore the User from the Azure AD Deleted Users Bin.
5. Run Start-ADSyncSyncCyle -PolicyType Delta on the server to confirm the error does not appear again.

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.