Microsoft Entra Connect Sync Errors – Duplicate UPN/proxyAddresses Between Cloud and On-Premises Users

Question

Rachit Sir 1.jpgVinay 1.jpgVinay.jpgShubham.jpgRachit Sir.jpg

We are currently configuring Microsoft Entra Connect synchronization between our on-premises Active Directory and Microsoft Entra ID. During synchronization, we are receiving multiple synchronization errors indicating that user attributes already exist on another object.

The errors are reported as AttributeValueMustBeUnique / duplicate attribute value conflicts.

We have identified several affected users. The screenshots show examples such as:

1. Rachit Agarwal – SGFX

The existing cloud-only object has:

• UPN: ******@sgfx.com
• Mail: ******@sgfx.com
• Object ID: 33268313-d11a-48f2-b4cf-86e058433a15
• Synchronization status: Cloud only
• Proxy addresses include SMTP:******@sgfx.com

The conflicting synchronized object has:

• UPN: ******@spectraglobaltd.onmicrosoft.com
• Mail: ******@spectraglobaltd.onmicrosoft.com
• Synchronization status: Synchronized to Microsoft Entra ID
• Different Object ID / Source Anchor

Microsoft reports this as a duplicate attribute conflict.We are currently configuring Microsoft Entra Connect synchronization between our on-premises Active Directory and Microsoft Entra ID. During synchronization, we are receiving multiple synchronization errors indicating that user attributes already exist on another object.

The errors are reported as AttributeValueMustBeUnique / duplicate attribute value conflicts.

We have identified several affected users. The screenshots show examples such as:

1. Rachit Agarwal – SGFX

The existing cloud-only object has:

• UPN: ******@sgfx.com
• Mail: ******@sgfx.com
• Object ID: 33268313-d11a-48f2-b4cf-86e058433a15
• Synchronization status: Cloud only
• Proxy addresses include SMTP:******@sgfx.com

The conflicting synchronized object has:

• UPN: ******@spectraglobaltd.onmicrosoft.com
• Mail: ******@spectraglobaltd.onmicrosoft.com
• Synchronization status: Synchronized to Microsoft Entra ID
• Different Object ID / Source Anchor

Microsoft reports this as a duplicate attribute conflict.
2. Vinay Zinzuvadiya – SGFX

The existing cloud-only object has:

• UPN: ******@sgfx.com
• Mail: ******@sgfx.com
• Proxy address: SMTP:******@sgfx.com

The conflicting on-premises synchronized object has:

• UPN: ******@sgfx.com
• Mail: ******@sgfx.com
• Distinguished Name: CN=Vinay Zinzuvadiya - SGFX,OU=Trading,OU=SGFX-Users,DC=ad,DC=sgfx,DC=com
• Different Object GUID / Source Anchor

The error specifically indicates that ProxyAddresses / UPN values are already associated with another object.2. Vinay Zinzuvadiya – SGFX

The existing cloud-only object has:

• UPN: ******@sgfx.com
• Mail: ******@sgfx.com
• Proxy address: SMTP:******@sgfx.com

The conflicting on-premises synchronized object has:

• UPN: ******@sgfx.com
• Mail: ******@sgfx.com
• Distinguished Name: CN=Vinay Zinzuvadiya - SGFX,OU=Trading,OU=SGFX-Users,DC=ad,DC=sgfx,DC=com
• Different Object GUID / Source Anchor

The error specifically indicates that ProxyAddresses / UPN values are already associated with another object.

3. Shubham Sharma – SGFX

The existing cloud object has:

• UPN: ******@sgfx.com
• Mail: ******@sgfx.com
• Proxy address: SMTP:******@sgfx.com

The conflicting synchronized object has:

• UPN: ******@cosmic-trades.com
• Mail: ******@sgfx.com
• Different Object GUID / Source Anchor

Again, Entra Connect reports a duplicate attribute conflict.

What we are trying to achieve

We want the existing cloud users to be matched/merged with the corresponding on-premises AD users, rather than creating duplicate users in Microsoft Entra ID.

We want to preserve the existing cloud identities and avoid accidentally deleting or recreating users, because these accounts may already have Microsoft 365/Entra resources, licenses, groups, permissions, mailbox/OneDrive data, MFA configuration, etc.3. Shubham Sharma – SGFX

The existing cloud object has:

• UPN: ******@sgfx.com
• Mail: ******@sgfx.com
• Proxy address: SMTP:******@sgfx.com

The conflicting synchronized object has:

• UPN: ******@cosmic-trades.com
• Mail: ******@sgfx.com
• Different Object GUID / Source Anchor

Again, Entra Connect reports a duplicate attribute conflict.

What we are trying to achieve

We want the existing cloud users to be matched/merged with the corresponding on-premises AD users, rather than creating duplicate users in Microsoft Entra ID.

We want to preserve the existing cloud identities and avoid accidentally deleting or recreating users, because these accounts may already have Microsoft 365/Entra resources, licenses, groups, permissions, mailbox/OneDrive data, MFA configuration, etc.

Questions

1. What is the recommended Microsoft-supported method to resolve these AttributeValueMustBeUnique conflicts?
2. Should we modify the UPN and/or proxyAddresses attributes on the on-premises AD objects before running synchronization?
3. Is soft matching / hard matching appropriate in this situation?
4. How can we safely match the existing cloud-only users to the corresponding on-premises users while preserving the existing cloud object?
5. For users such as Rachit, where the cloud object and synchronized object have completely different Object IDs and Source Anchors, what is the safest approach?
6. Is there a recommended sequence of steps to resolve these conflicts without causing duplicate accounts or loss of Microsoft 365 data/access?
7. After correcting the attributes in on-premises AD, what is the recommended way to verify that Entra Connect will join the objects rather than create a new cloud object?

We are currently unable to open a Microsoft support ticket with a Microsoft engineer because our Azure subscription is disabled due to a billing issue. Therefore, we would appreciate guidance on the safest Microsoft-supported procedure for resolving these synchronization conflicts.

Screenshots of the synchronization errors are attached for reference.