Duplicate Attribute Error

Question

I recently synced my On-Premise AD with Azure. The sync was fast and although it worked, I have the Duplicate Attribute Error with a lot of my users. Our domain is the same in Azure as it is on the On-premise server. Usernames are also the same.

I thought that these profiles would merge or something, but instead it has created new users in Azure with unique usernames that are not the same as in our server. If I create a user in Active Directory it is also not adding that user in Azure. I have also tried creating the user in Azure to see if it replicates and that is also a bust.

What have I done wrong? Am i going to have to create a user in multiple places SSO to work with other applications? Am I just really confused as to what syncing AD to Azure actually did for me?

Answer 1

Hello @Chip Parham

Thank you for reaching out. I would like to share following details with you:

• When you install Microsoft Entra Connect and you start synchronizing, the Azure AD Sync service (in Microsoft Entra ID) does a check on every new object and tries to find an existing object to match.
• There are three attributes used for this process: userPrincipalName, proxyAddresses, and sourceAnchor/immutableID.
• A match on userPrincipalName or proxyAddresses is known as a soft match.
• A match on sourceAnchor is known as hard match.
• For the proxyAddresses attribute only the value with SMTP:, that is the primary email address, is used for the evaluation.
• The match is only evaluated for new objects coming from Connect.
• If you change an existing object so it is matching any of these attributes, then you see an error instead.

In short, when you have existing tenant, you would need to make sure that following attributes match for user whom you are trying to perform soft match.

• userPrincipalName and SMPT proxyAddresses should be same as cloud user.
• EnableSoftMatchOnUpn feature should be turned on Azure AD Connect. (More details available on following: https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/use-upn-matching-identity-sync)
• For complete details please review: How to Sync with existing users in Microsoft Entra ID.

I hope this helps and hence would request you to please "Accept the answer" if the information helped you. This will help us and others in the community as well.