OneDrive Site User ID Mismatch

Question

I have a user who left the company and returned more than 30 days later so their previous account was deleted and a new one was made that had the exact same username/email address as the old account which is what I'm finding causes this ID mismatch issue. Apparently, there's some artifact leftover on the backend that ties her new account to her old ID and the system is looking at the deactivated ID and saying "Nope, it doesn't have access because it's deactivated." Unfortunately, I submitted a ticket on 6/10 and it's still not resolved. Support seems to have no documentation on how to resolve this issue. The fact that the diag tool can diagnose the issue and tells us to contact Support but Support hasn't been given documentation on the resolution is infuriating.

• User cannot access any shared OneDrive files regardless of who shares them, how they're shared (sharing link or direct access), or how she attempts to access them (direct link or sharing link). This includes files shared in Teams from a OneDrive account. All shared file permissions have been verified. The files we're testing with have been shared with People at (Company) with the link can view AND have been shared with her directly after she used the You need permission to access this item form to request access and it was Accepted from the notification email.
• She can access her own OneDrive
• This is only affecting OneDrive files; it does not affect our main SharePoint site collection or files uploaded to a Team rather than shared with a Team.
• She has also tried using the Request Access form to ask for access and the owner has chosen Accept on the email which caused her to receive a confirmation email that she was granted access but clicking on Go to item still doesn't allow her access.

For the last few days Support has just been telling me that they're reviewing the issue. I'm in a nightmare with this issue.

Answer 1

This issue is now resolved.

Cause

The user's new account and old account were in conflict. The source of the conflict existed in the user permission records on the OneDrive accounts of those sharing with the affected user. These users had shared files with her old account, creating a user permission record on their OneDrive accounts. This record remained after the account was deleted so when the new account was created, a new user permission record was not created on the sharing user's OneDrive account and OneDrive was attempting to use that old record to authenticate.

Resolution

The resolution must be carried out on each individual OneDrive account of those unable to share with the affected user. A Global Admin or SharePoint admin can carry these tasks out, or it can be delegated to the sharing user. If performing this task as an admin, you must first add yourself as a site collection owner on the account of the sharing user. To do this, go to the SharePoint admin center, click on More features, then Open the User profiles section. Search for the sharing user and in the results section, click on the drop-down arrow beside their Account name. Select Manage site collection owners and in the window that appears, add your own account under Site Collection Administrators. This will allow you access to their OneDrive and the ability to remove the old account from the user permissions.

1. Navigate to the SHARING user's OneDrive All People permission list by pasting /_layouts/15/people.aspx?MembershipGroupId=0 at the end of the user's main OneDrive URL (https://mainsite-my.sharepoint.com/personal/user_email_address_com -- the format of the user's email may not match what I've written; that's the format of my company's email addresses.)
2. Locate the affected user in the list and hover over their name and a URL will appear in the status bar area. Note the ID=#### at the end. Do not click on the user, only hover to reveal the ID.
   
3. Go to the userdisp.aspx page by pasting /_layouts/userdisp.aspx?id=10&force=true onto the user's OneDrive URL and replacing the 10 with the number of the ID from the previous step. For this example screenshot the ID is 266 so you would paste /_layouts/userdisp.aspx?id=266&force=true onto the OneDrive URL.
4. You will be taken to a People and Groups > User information page with the affected user's information listed. Confirm it is the affected user, then click Delete User from Site Collection. Confirm the deletion.
5. Upon deletion, you will be returned to the People and Groups > All People list from step 1.
6. All files must be re-shared with the affected user.

Answer 2

Had the same problem, Powershell script to remove the mismatched user from ALL the users in the company is as follows:

#Set Parameters
$AdminCenterURL="https://yourcompany-admin.sharepoint.com/"
#user with the ID mismatch
$UserLoginID = "i:0#.f|membership|name.surname@yourcompany.com"
#enter user, that is sharepoint admin
$SiteCollectionAdmin = "sharepoint.admin@yourcompany.com"
 
#Connect to SharePoint Online
Connect-SPOService -Url $AdminCenterURL
 

#Get all Personal Site collections
$PSitesUrl = Get-SPOSite -Template "SPSPERS" -limit ALL -includepersonalsite $True | Select URL

Foreach ($PSiteUrl in $PSitesUrl.url)
{
	#Add Site collection Admin
	Set-SPOUser -site $PSiteUrl -LoginName $SiteCollectionAdmin -IsSiteCollectionAdmin $True
    
	#remove the user from "All people" personal site
	Remove-SPOUser -Site $PSiteUrl -LoginName $UserLoginID

	#Remove Site collection Admin
	Set-SPOUser -site $PSiteUrl -LoginName $SiteCollectionAdmin -IsSiteCollectionAdmin $False
}

The users that dont have the problematic mismatched-user in their "all people" group, produce an error "Remove-SPOUser : Cannot complete this action." (didn't have time to investigate), but the script works and does the job.

Answer 3

Hi @Emily Nelson
This issue most frequently occurs when a user is deleted and re-created with the same user principal name (UPN). The new account is created by using a different Unique ID value. When the user tries to access a site collection or OneDrive, the user has an incorrect ID.

To fix this issue, delete the new UPN if it exists, and then restore the original UPN.

For more information, you could refer to:
https://learn.microsoft.com/en-us/sharepoint/troubleshoot/administration/access-denied-or-need-permission-error-sharepoint-online-or-onedrive-for-business

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.