email-enabled security group synchronized from the local active directory is not deleted in Exchange online after entra id sync

Question

An email-enabled security group synchronized from the local active directory is not deleted in exchange online after it has been deleted in the local AD and a sync to entra id has taken place.

Can anyone provide support here?

Answer 1

Hello @Markus Schädlich

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this.

Issue: email-enabled security group synchronized from the local active directory is not deleted in Exchange online after entra id sync

Azure Trusted signing failure

Solution: The Group had an automatic Group license assignment. The Group was deleted After removing the assignment.

Issue is resolved by @Markus Schädlich

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

Answer 2

Hi at all, sorry for my late reply. The Group had a automatic Group license assignment. The Group was deleted After removing the assignment. Thank you

Answer 3

Hello @Markus Schädlich,
Thank you for contacting Q&A Forum. I would like to provide my findings and proposed solution:

As you mentioned, the email-enabled security group has been deleted from your local Active Directory. If, as expected, a check in your metaverse and connector space (using the guidance in this documentation) confirms the group is no longer present, this indicates that the synchronization from your local AD to Microsoft Entra ID has completed successfully.

However, since the group still exists in Exchange Online, it suggests that the deletion has not been propagated from Entra ID to Exchange Online. The entire sync process follows this sequence: Local AD → Entra ID → Exchange Online. With the group removed in your on-premises AD and (presumably) Entra ID, the remaining step is to address its persistence in Exchange Online.

To resolve this, please safely remove the group from Exchange Online by using the Remove-DistributionGroup command. We recommend collaborating with an Exchange Online specialist to perform this removal to ensure that it's carried out correctly and without further issues.

Kindly let me know if this work for you and please let me know if you have any further question.

If I have answered your question, please accept this as answer as a token of appreciation and don't forget to thumb up for "Was it helpful"!

Best regards,
Eric

Answer 4

Hello @Markus Schädlich

If an email-enabled security group is deleted in your local Active Directory but still appears in Exchange Online after synchronization, it’s likely because the deletion didn’t fully propagate through the sync process.

Even when the group is removed from both Active Directory and Entra ID, Exchange Online may retain a copy if it was mail-enabled. This is common in hybrid environments where Exchange Online does not receive a proper deletion signal.

To resolve this:

1. Use PowerShell to check if the group still exists in Exchange Online.
2. If it does, and you’ve confirmed it's no longer present in your on-premises AD or Entra ID, you can safely remove it manually using the Remove-DistributionGroup command.

Before taking action, ensure synchronization is running properly and confirm that the group is no longer needed. You may also try initiating a full sync cycle to verify changes have been applied.

https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-mail-enabled-security-groups

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-object-not-syncing#connector-space-object-properties

I hope this helps. If you have any questions or need further assistance, please don’t hesitate to reach out — we're here to help.

Answer 5

Have you checked the status of the group in the Metaverse? Follow the steps in this article: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-object-not-syncing#connector-space-object-properties

You might also consider starting a full sync cycle.