In dev.azure, user's access level is automatically changing to stakeholder from Basic. Duplicate identity causing 500 login error and infinite license loop in Azure DevOps
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(297.6, 6%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENG%3C/text%3E%3C/svg%3E)
Nirbhay Giri
20
Reputation points
Organization: ACPLApps (dev.azure.com/ACPLApps)
Affected users:
Problem:
Audit logs show "Duplicate identity found" every 30 seconds.
Azure DevOps Service automatically removes Basic license and
assigns Stakeholder in a loop. Users cannot login - 500 error.
Already done:
- Permanently deleted old identities from Microsoft Entra
- Removed and re-added users multiple times
- Ghost identity still persists in Azure DevOps backend
Need backend identity/descriptor cleanup for these users.
Azure DevOps
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(19.2, 14.000000000000002%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESD%3C/text%3E%3C/svg%3E)
Siddhesh Desai 7,240 Reputation points Microsoft External Staff Moderator2026-06-10T07:27:18.2166667+00:00 Thank you for reaching out to Microsoft Q&A.
Please provide the information I have asked on Private chat to create a backend ticket.
The issue occurs due to a duplicate identity (Graph descriptor) conflict in Azure DevOps backend, where multiple identity records are mapped to the same user (same UPN/email). Because of this mismatch, Azure DevOps is unable to resolve a single valid identity and keeps re-evaluating the user access. This results in continuous backend sync attempts, which is why you are seeing “Duplicate identity found” logs frequently. Due to this conflict, the system automatically removes the Basic license and assigns Stakeholder repeatedly, causing an infinite loop and ultimately leading to login failures (500 error). Even after deleting users from Microsoft Entra ID and re-adding them, the issue persists because the duplicate/ghost descriptor still exists in the Azure DevOps backend and is not visible via UI or standard APIs.
Refer below points to resolve this issue or this is the workaround
Remove all existing Graph memberships for the affected identity descriptor
Ensure the user descriptor is removed from all Azure DevOps groups, teams, and permissions using Graph APIs or CLI. Even if the user is deleted from Entra ID, residual memberships can cause the identity to be rehydrated.
Completely remove both old and new identities from Azure DevOps
If multiple identities (old UPN/email and new UPN/email) are mapped to the same user, both must be removed completely from:
- Organization users
- Project-level users
- Security groups and teams Once removed, re-add the user with the correct identity to avoid duplication issues.
Recreate and re-add the user cleanly
After cleanup, recreate the user in Microsoft Entra ID (if needed) and then add the user again to Azure DevOps. Assign the Basic license only after confirming that login works without errors.
Important note
This is not a licensing issue but an identity synchronization issue in Azure DevOps. In scenarios where stale or duplicate identity records exist in the backend, only Microsoft internal cleanup can fully resolve the problem.
-
-
Sign in to comment
Sign in to answer