Delete Users in Azure Active Directory Admin Center that were Synced from On-Premise AD

Christopher Russell 1 Reputation point
2021-03-16T17:26:32.307+00:00

Hello,

I was wondering if someone could help me answer this question. I have users in Azure Active Directory Admin Center that were directory synced from an on-premises Active Directory. These users have been deleted from the on-premise Active Directory but they still exist in Azure Active Directory. Is there any way to use synchronization to remove these users from Azure Active Directory Admin Center?

A little background on how this happened. My boss signed up for Microsoft Office 365 and he created user accounts for everyone in the IT dept directly in Office 365. This Office 365 was supposed to be for the staff only and my boss wanted us to input the rest of the staff. My boss suggested either having separate cloud accounts for the staff, or we could do Ad connect to keep it as a single login for the staff. We decided to do AD connect because one less sign-in the better since our staff already have a minimum of three and have a hard time with those already. So when we installed AD connect we allowed it to sync everything. The problem comes in that we have a ton of students in our Active Directory, and they use Chromebooks. There is no need for them to have domain accounts or for those to have been synced into Azure Active. Yes I know, if we would have done it differently, we could have synced just the OU's we wanted and bypassed this mess. So we went ahead and deleted all of those users from our on-premises Active Directory, but after 7 days of delta Syncs, delta imports, and exports, these student users still exist in our Azure Active Directory Admin Center.

I have been searching and not really finding a concrete answer. I have also used the following to try and get a solid understanding of the process.

https://techcommunity.microsoft.com/t5/tag/Synchronization/tg-p/board-id/CoreInfrastructureandSecurityBlog

https://medium.com/alexfilipin/azure-ad-connect-dispel-the-fear-33446616de12

So when I use the Synchronization Service from Azure AD Connect GUI, I see on the AAD after a delta Sync or a Full Sync that there are 1049 disconnectors. When I use the connector space and change the scope to Pending Import and checkmark add, it's the same 1049 and the student accounts that were deleted from the On-Premise AD. So have these accounts been orphaned? If they are orphaned then is the only way to get rid of them is through bulk deletion? Is there no way for me to use synchronization to export the On-Premise AD to AAD and overwrite everything?

https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/object-deletions-not-sync

I know this is a lot and hopefully, I explained it well enough that I didn't lose anyone. Any help that can be given is appreciated.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,527 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Vasil Michev 100K Reputation points MVP
    2021-03-16T20:51:24.083+00:00

    Forcing a Full sync should resolve this, alternatively you can delete them directly in Azure AD via the Remove-MsolUser cmdlet: https://learn.microsoft.com/en-us/powershell/module/msonline/remove-msoluser?view=azureadps-1.0