How to Sync On-Premise User password change to 365 Entra

Question

Dear Experts,

Good day.

Background

I have migrated on-premise Exchange to 365 Exchange way back 2 years ago.

I have a 365 environment with GLOBAL admin access and in AD Server Admin access (on-premise).

Installation and Troubleshooting: Experiences Setting Up EntraADConnect

I am attempting to use EntraADConnect installed on a different server and targeting a specified OU in AD for syncing purposes. Objects have the same UPN and Primary Email in AD and Entra ID.

However, i am having issues syncing - the error show below (conflict in ProxyAddresses).

- Removing Proxy Address (email) on AD object fixes the issue however, will create new user on ENTRA ID with different UPN - the result not I wanted.

I have read some solutions to do Hard Match and tried to convert AD object GUID to base64 and applied to target ENTRA ID ImmutableID field but it still not work.

WHAT I WANT TO ACHIEVE

• I want to sync password changes on on-premise to 365 environment to avoid confusion logging in on 365 Exchange without any changes to end users.
• I want to have a central password store for on-premise and 365.
• On-premise AD should act as the source of password for all synced objects.

Can you help me how to make this work based on what I want to achieve?

Regards,

Answer 1

This appears to be an object matching problem. Since the users already exist in Entra ID from your previous Exchange Online migration, Entra Connect is trying to create or join the on-premises AD objects with existing cloud objects. The ProxyAddresses conflict indicates that another Entra ID object already owns the same SMTP address, so Entra Connect cannot complete the join.

Removing the proxy address from AD works because it removes the conflict, but it causes Entra Connect to create a new cloud object because the existing Entra object is not being matched correctly. To fix this, hard match the existing Entra ID user with the on-premises AD user by setting the cloud user's ImmutableID to the Base64-encoded objectGUID of the AD account before enabling synchronization.

For details, refer to https://michev.info/blog/post/6129/how-to-hard-match-entra-id-users-via-the-graph-api-or-the-graph-sdk-for-powershell

If this was done and it still failed, verify that you used the correct AD object's objectGUID, that the ImmutableID was actually applied, and that no other Entra object already has the same proxy address.

Also check for duplicate objects in Entra ID (especially guest users, soft-deleted users, or previously migrated accounts) that may hold the same proxyAddresses value. You can verify this with Microsoft Graph PowerShell or Entra admin center searches for the SMTP address.

For your goal of having on-premises AD as the password source, you need to configure Entra Connect with Password Hash Synchronization (PHS). After the users are correctly matched and synchronized, password changes made in on-premises AD will be synchronized to Microsoft 365, giving users a single password experience. You do not need Exchange hybrid for this; Exchange Online can remain cloud-only while AD remains the identity source.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin