Ad Sync Issues - Attribute Value Must be Unique - Ransomeware Attack

Question

Hi there,

Recently one of my customer was hit by Ransomware and we have to delete complete AD and start from fresh.

We have now fresh AD and trying to sync with users already on M365 (that were synced using old AD).

Was trying to sync couple of users initially but getting below error.

UPN - same in AD as well as M365
SMTP - Same in AD as well as M365

Error:

Any help would be greatly appreciated.

Thanks,
J

Answer 1

Existing objects in Azure AD that are/were previously synced will have a sourceAnchor(aka ImmutableID) value in Azure AD. Presence of an ImmutableID value means that soft-matching is not possible. In order for your objects to match, you will have to either:

A) Clear the ImmutableID values of the users in Azure AD (after disabling DirSync on the tenant via these steps: https://learn.microsoft.com/en-us/microsoft-365/enterprise/turn-off-directory-synchronization?view=o365-worldwide) ) and then let the users soft-match

OR

B) Populate the mS-DS-ConsistencyGUID values of the on-prem users match the base16 conversion of the ImmutableID values of their respective users in the cloud. ImmutableID is commonly stored in base64 whereas the mS-DS-ConsistencyGUID value needs to be base16. AAD Connect takes care of the conversion.

Option A is going to be easier if you aren't familiar with the mS-DS-ConsistencyGUID concept. You would also likely be served well by opening a support case to get some guidance and hand-holding through the process.