Microsoft Security | Microsoft Entra | Microsoft Entra External ID
Managing external identities to enable secure access for partners, customers, and other non-employees
Azure Active Directory Issue
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 38%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECG%3C/text%3E%3C/svg%3E)
Chaiki Gan Bee Suan 顏美碹
0
Reputation points
We have no any idea that why 6 users did not sync with Microsoft Active users ? Could you please advise the solution ?
Microsoft Security | Microsoft Entra | Microsoft Entra External ID
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 10%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Shubham Sharma 17,675 Reputation points Microsoft External Staff Moderator2026-01-19T07:52:08.0466667+00:00 Thank you for reaching out to Microsoft Q&A.
Below are the resolution steps:-
- Users Are Outside the Azure AD Connect Sync Scope
What to check
- Are the 6 users located in an OU excluded from synchronization?
Microsoft doc
- Azure AD Connect sync scope
Doc: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-custom
Move users to a synced OU or update Azure AD Connect OU filtering.
- User Accounts Are Disabled in On‑Prem Active Directory
Microsoft states that disabled AD accounts may not sync depending on configuration.
What to check
-
AccountDisabled = Truein Active Directory
Resolution
- Enable the user accounts → run a Delta Sync.
- Duplicate or Invalid UserPrincipalName (UPN)
Microsoft Entra ID requires globally unique UPNs.
Common problems
- Duplicate UPNs
- Unsupported suffix (e.g.,
.local) - UPN suffix not verified in Microsoft 365
Microsoft doc
- UPN requirements and errors
Doc: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-sync-errors
Resolution
- Assign a verified UPN suffix (e.g.,
@company.com) - Ensure each user has a unique UPN.
- Attribute Conflicts (proxyAddresses, mail)
If two users share the same email or proxy address, sync fails.
Microsoft doc
- Duplicate attribute sync errors
Resolution
- Remove duplicate
proxyAddressesormailattributes.
- User Already Exists in Azure AD (Conflict Object)
If the user was manually created in Microsoft 365, Azure AD Connect cannot match it automatically.
Microsoft doc
- Duplicate object / hard‑match errors
Doc: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-objectsync
Resolution
- Soft match: Align UPN & mail
- Hard match (if required): Set ImmutableID per Microsoft guidance.
- Azure AD Connect Sync Errors
Microsoft explicitly recommends checking Sync Service Manager for user‑level failures.
What to check
- Azure AD Connect → Synchronization Service Manager
- Export errors or skipped objects
Microsoft doc
- Troubleshoot Azure AD Connect sync
Resolution
- Fix reported attribute errors
- Run:
Start-ADSyncSyncCycle -PolicyType Delta
-
Shubham Sharma 17,675 Reputation points Microsoft External Staff Moderator
2026-01-20T07:42:17.2833333+00:00 Following up to check if the resolution provided above was helpful. Please let us know if you need any further assistance.
Sign in to comment
Sign in to answer