Forum Discussion
PHS staged rollout works for existing users but not new synced users
We are troubleshooting an Entra ID PHS staged rollout issue with a federated domain using a third-party WS-Fed IdP.
The intended behavior is that normal federated users redirect to the IdP, while users in the PHS staged rollout group receive the Microsoft/Entra password prompt instead.
Existing users in the staged rollout group continue to work correctly. They enter their UPN and receive the Microsoft password prompt. One known-good test user is not provisioned in the third-party IdP and still signs in successfully through the Entra password prompt, so the working path does not require the user to exist in the IdP.
The issue is only with newly created AD-synced users. Newly synced users in the same staged rollout group are still being routed to the federated IdP at HRD instead of receiving the Entra password prompt.
We’ve verified the staged rollout policy and group membership from Graph, confirmed the affected users are properly AD-synced with clean immutableID/sourceAnchor, and confirmed PHS is working. Federation metadata and HRD policies also look clean. Seamless SSO/AZUREADSSOACC was checked and remediated, but the behavior did not change.
For failed attempts, there is no Entra sign-in log entry, including tenant-wide interactive and non-interactive logs. However, the federated IdP logs show a WS-Fed inbound request from login.microsoftonline.com for the affected user. That makes it look like Entra HRD is routing the user to federation before sign-in logging or token issuance.
The issue started around an Entra Connect AD connector/DC-path change. We have since reverted the connector to the previous known-good configuration. After reverting, we created a clean-room test user with the correct UPN set before first sync, confirmed sync/PHS/sourceAnchor, added the user directly to the staged rollout group, and waited 60+ minutes. The clean-room user still redirected to the federated IdP instead of getting the Entra password prompt.
So the current behavior is that established staged-rollout users still get the Entra password prompt, but newly created synced staged-rollout users are sent to the federated IdP by HRD.
Has anyone seen staged rollout get into this state, where existing users work but new synced users remain on the federated HRD path despite valid rollout policy, group membership, synced password hash, and clean immutableID/sourceAnchor? Is there any known backend cache/state reset or escalation path for HRD/staged rollout routing?
4 Replies
Hi, when staged rollout works for existing users but not new synced users, I would look closely at group membership timing and sync state.
Things to check:
1. Confirm the new users are in the staged rollout group in Entra ID.
2. Confirm the group itself is in the staged rollout configuration.
3. Check whether group membership is direct or dynamic, and whether dynamic processing has completed.
4. Verify password hash sync has completed for the new users.
5. Check sign-in logs to see whether the user is still being routed to federation.
My hunch would be timing or group scope first, then PHS state second.
We've been leveraging just a single group for staged rollout and have had it in place for a long time (like over a year). All members are direct members and PHS is complete.
I also tried the route of creating a cloud user, place them into a staged rollout group, hard match to on-prem AD and see if they could still login without being redirected to the federation. It still redirected.
I've just come across this issue as well. Existing users in the staged rollout group are being prompted for username/password upon entering their UPN but new users are being redirected to the idP, despite being the same staged rollout group. I've confirmed all the same details and am stuck at this time.
Our issue also came during a change to the Entra Connect AD connector but we haven't reverted ours.
We just ran into this today. Our process has been in place for over a year. No updates to Entra Connect recently, but today all of the new Mac users are being redirected to the federated IdP, even though their accounts are in Staged rollout and audit logs shows successfully converted to PasswordHashSync. We have a case open with MS and waiting for a response from the product group. New Windows users are NOT having this issue. No idea why.
