disabled AD users are being deleted from Entra

Question

we are running a hybrid environment, and are using the latest Microsoft Entra Connect Sync as of 31/07/25. The problem is that disabled AD users are being soft deleted within Entra. The OU is being synced but it still happens.

Answer 1

Dear Damon Admin ,

Thank you for providing context regarding your hybrid environment and the recent behavior observed with Microsoft Entra Connect Sync.

Based on your description, it appears that disabled Active Directory (AD) users are being soft deleted in Microsoft Entra ID, despite the Organizational Unit (OU) being included in the sync scope. This behavior can occur under specific conditions related to synchronization rules and source anchor integrity.

Possible Causes

Filtering Configuration If the OU is included but custom filtering is applied (e.g., via attribute-based filtering or domain-based scoping), disabled users may be excluded unintentionally, triggering soft deletion.

Source Anchor or ImmutableID Mismatch If a user’s source anchor (typically objectGUID) changes or is missing, Entra may interpret the object as removed and initiate a soft delete.

Sync Rule Behavior Default sync rules may treat disabled users as deletable if they no longer meet inclusion criteria. This can be modified via custom synchronization rules.

Staging Mode or Delta Sync Issues If Entra Connect was recently updated or switched out of staging mode, delta syncs may misinterpret changes, especially if the connector space wasn't fully refreshed.

Recommended Actions

1. Review Synchronization Rules
   • Open Synchronization Rules Editor and verify that disabled users are not being filtered out by default or custom rules.
   • Ensure that userAccountControl or similar attributes are not used to exclude disabled accounts.
2. • Verify OU Inclusion
     • In Entra Connect, confirm that the OU containing disabled users is selected under Configure Directory Partitions.
     • Run a Full Sync to ensure all objects are re-evaluated:

             Start-ADSyncSyncCycle -PolicyType Initial
             
       

3. Check Soft Deleted Objects in Entra

Use the Microsoft Entra admin center or PowerShell to confirm which users are soft deleted:

Get-MgUser -Filter "accountEnabled eq false"

• Restore users if needed using:

    Restore-MgDirectoryDeletedItem -DirectoryObjectId <ObjectId>
    
  

4. Enable Soft Delete Protection (Optional)

Consider implementing Entra ID Protection policies or custom sync rules to prevent automatic deletion of disabled users.

Best regards,

Quinnie Quoc.