Azure DevOps Graph resolves renamed B2B guest user to obsolete identity

Question

Azure DevOps Graph resolves renamed B2B guest user to obsolete identity

Ladislav Chlum (Admin) 0

We have an Azure DevOps organization named "axp".

A guest user from partner tenant ABC was renamed from:

******@ABC.com

to

******@ABC.com

Actions already performed:

Removed the original guest account from Entra ID.
Invited and recreated the guest user with the new email address.
Guest invitation has been accepted.
Azure DevOps user entitlement was removed and recreated.
Azure DevOps organization user was removed.

Current Entra ID guest account:

Display Name: Gisela Z

Email: ******@ABC.com

Object ID: PII

However Azure DevOps Graph still resolves the user as:

Display Name: Gisela J

Email: ******@ABC.com

Origin ID: PII

Descriptor: aad.YTpIIIw

Even after removing the user and inviting ******@ABC.com again, Azure DevOps automatically recreates the historical identity ******@ABC.com.

The user is unable to authenticate successfully.

Please verify whether the Azure DevOps Graph identity cache or descriptor mapping can be reset or removed.

Vallepu Venkateswarlu 10,260 Reputation points Microsoft External Staff Moderator

2026-07-03T10:29:22.8966667+00:00
Hi Ladislav Chlum (Admin),

Welcome to Microsoft Q&A Platform.

It looks like you’ve run through all the usual steps in Entra ID and in Azure DevOps, but DevOps is still hanging on to the old B2B guest descriptor.

Azure DevOps Services maintains its own Graph-identity cache for performance, and deleting & re-inviting a guest doesn’t immediately purge that cache it can take up to 24 hours to naturally expire, and there’s no customer-exposed “flush cache” switch right now.

Reset the guest’s redemption status in Entra ID instead of deleting+recreating

In the Microsoft Entra admin center (or via PowerShell/Graph), use the “Reset redemption status” feature to update the user’s sign-in email. That preserves the existing object ID, app assignments and group memberships, so Azure DevOps sees it as the same identity but with the new email.

Docs: Microsoft Entra → External ID → Reset redemption status for a guest user

Wait for the Azure DevOps Graph cache to refresh

Azure DevOps pulls identity details from Entra and caches them for a period (typically up to 24 hours). Once that TTL lapses, you should see the new display‐name/UPN flow through automatically without touching the user.

In the meantime, the old descriptor will still appear in Azure DevOps and continue to block sign-in.

References: Reset the redemption status for a guest user in Microsoft Entra External ID
Troubleshoot sign-in and connectivity in Azure DevOps

If the above steps did not help resolve your issue, please feel free to share the details in a private message so we can proceed with further troubleshooting over a Teams call. I am happy to connect with you on Teams to investigate and resolve the issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.

1 answer

Your answer

Vallepu Venkateswarlu 10,260 Reputation points Microsoft External Staff Moderator

2026-07-03T10:29:22.8966667+00:00

Hi Ladislav Chlum (Admin),

Welcome to Microsoft Q&A Platform.

It looks like you’ve run through all the usual steps in Entra ID and in Azure DevOps, but DevOps is still hanging on to the old B2B guest descriptor.

Azure DevOps Services maintains its own Graph-identity cache for performance, and deleting & re-inviting a guest doesn’t immediately purge that cache it can take up to 24 hours to naturally expire, and there’s no customer-exposed “flush cache” switch right now.

Reset the guest’s redemption status in Entra ID instead of deleting+recreating

In the Microsoft Entra admin center (or via PowerShell/Graph), use the “Reset redemption status” feature to update the user’s sign-in email. That preserves the existing object ID, app assignments and group memberships, so Azure DevOps sees it as the same identity but with the new email.

Docs: Microsoft Entra → External ID → Reset redemption status for a guest user

Wait for the Azure DevOps Graph cache to refresh

Azure DevOps pulls identity details from Entra and caches them for a period (typically up to 24 hours). Once that TTL lapses, you should see the new display‐name/UPN flow through automatically without touching the user.

In the meantime, the old descriptor will still appear in Azure DevOps and continue to block sign-in.

References: Reset the redemption status for a guest user in Microsoft Entra External ID
Troubleshoot sign-in and connectivity in Azure DevOps

If the above steps did not help resolve your issue, please feel free to share the details in a private message so we can proceed with further troubleshooting over a Teams call. I am happy to connect with you on Teams to investigate and resolve the issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.

Answer 1

Hi Ladislav Chlum (Admin),

Thank you for your patience.

Based on the information provided, the issue appears to be related to the Azure DevOps Graph identity continuing to reference the historical guest identity after the guest account was recreated in Microsoft Entra ID.

Recommended resolution:

Instead of deleting and recreating the guest user when only the email address changes, Microsoft recommends using Reset Redemption Status in Microsoft Entra ID.

This updates the guest's sign-in email while preserving the existing Object ID, allowing Azure DevOps to continue recognizing the same identity without creating a new Graph mapping.

If the guest has already been deleted and recreated, Azure DevOps may continue to reference the previous identity mapping. Currently, there is no customer-facing option to manually reset or remove the Azure DevOps Graph identity cache or descriptor mapping. Identity information is synchronized from Microsoft Entra ID and will refresh automatically over time.

As we have not received any further updates, If the issue persists after the identity synchronization completes, or if you have additional findings, please feel free to share the response. We'll be happy to continue assisting you.

If the above steps did not help resolve your issue, please feel free to share the requested details in a private message so we can proceed with further troubleshooting over a Teams call. I am happy to connect with you on Teams to investigate and resolve the issue.

Thank you for working with Microsoft Support