Duplicated AD computer in the Azure AD / Entra Devices | All devices page?

Question

I am using Hybrid OnPremise AD DS with Azure AD (Entra) synchronized using Azure AD connect.

When I look in the Azure AD / Entra Devices | All devices page https://portal.azure.com/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null

there are multiple entries for most of my AD computers like in the below screenshot:

How can I safely delete the duplicated AD computer as the above, and then leave the most recent or the valid entry only to maintain uniqueness?

Answer 1

Hello @EnterpriseArchitect

When the same device ends up with two different identities in Azure AD, it is known as a Dual state in AAD terminology. This usually happens when your users add their accounts to apps on a domain-joined device, they might be prompted with Add account to Windows, and if they enter Yes on the prompt, the device registers with Azure AD. The trust type is marked as Azure AD registered. After you enable hybrid Azure AD Join in your organization, the device also gets hybrid Azure AD joined. Then two device states show up for the same device.

Note: Hybrid Azure AD join takes precedence over the Azure AD registered state. So, your device is considered hybrid Azure AD joined for any authentication and Conditional Access evaluation. You can safely delete the Azure AD registered device record from the Azure AD portal. If the duplicate devices are very old and stale you can also check out steps mentioned on following document to clear those device entries: How To: Manage stale devices in Azure AD

Additionally, you can check out the instructions provided under Handling devices with Azure AD registered state, if you want to avoid such a scenario.

I hope this helps and hence would request you to please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hello EnterpriseArchitect,

Thank you for your question and for reaching out with your question today.

When you see multiple entries for the same AD computer in Azure AD/Entra, it's likely due to the synchronization process or other factors that cause duplicate computer objects to be created. To safely delete duplicated AD computer entries and maintain uniqueness, follow these steps:

**Note**: Before proceeding, always back up your Active Directory and Azure AD/Entra environments. Deleting objects can have irreversible consequences, so proceed with caution.

1. **Identify the Valid Computer Object**:
   - In the Azure AD/Entra portal, find the duplicated computer entries.
   - Look for attributes like the computer name, last sync time, or other identifying information to determine which one is the most recent or the valid entry.

2. **Validate Azure AD Connect Synchronization**:
   - Ensure that Azure AD Connect is configured and running correctly on your on-premises server.
   - Check the synchronization schedule and logs to verify that the synchronization process is working as expected.

3. **Verify AD Computer Objects**:
   - On your on-premises Active Directory Domain Controller, locate the duplicated computer objects.
   - Check their properties and attributes to confirm that they represent the same physical computer.

4. **Backup and Delete Duplicated AD Computer Objects**:
   - Once you have identified the valid computer entry in Azure AD/Entra and verified its corresponding AD object on-premises, create a backup of your Active Directory.
   - After ensuring that you have valid backups, proceed to delete the duplicated AD computer objects on-premises.

5. **Wait for Synchronization**:
   - Once the duplicated computer objects are deleted from your on-premises Active Directory, wait for the Azure AD Connect synchronization to run (or manually initiate a synchronization).
   - This process will remove the corresponding duplicated entries from Azure AD/Entra during the next synchronization cycle.

6. **Check Azure AD/Entra for Cleanup**:
   - After synchronization completes, verify that the duplicated computer entries have been removed from the Azure AD/Entra portal.

7. **Monitor Future Synchronizations**:
   - Keep an eye on future Azure AD Connect synchronization cycles to ensure that no new duplicated computer entries are created.

8. **Audit and Troubleshoot**:
   - If the duplicated computer entries keep reappearing after the cleanup, audit your synchronization settings, and check for any issues with the synchronization process or your on-premises Active Directory.

Always exercise caution when deleting objects from your directory, and ensure that you have a valid backup strategy in place. Additionally, consider testing any changes in a lab environment before applying them to production. If you are unsure about any step or the impact of the changes, seek assistance from experienced IT professionals or Microsoft support.

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

If the reply was helpful, please don’t forget to upvote or accept as answer.

Best regards.