Forum Discussion
Using Cloud sync to sync AD to existing Entra Accounts
I want to sync in premise AD accounts with existing Entra accounts. The email on both accounts is the same, and I added the Entra/o365 suffix to the domain and set the UPN to that suffix, making both UPN(s) the same. It did not sync. It created a NEW Entra account. I thought I covered all my bases.
How can I get on premise AD and existing Entra accounts to sync?
thank you
3 Replies
Well, it was a disaster. I setup up a filter and the sync process was creating a new account (due to roles). I then changed the filter and it deleted everything. I removed the configuration and restored the accounts.
I then removed the roles on my test account (mine), then setup the configuration again with the filter pointing a test OU again, and now it won't sync as it recognizes there is an existing Entra account with conflicting attributes.
UPN, SMTP are the same in Entra and in AD.
Hi, matching only by email address can unfortunately be unreliable.
Before bringing the users into the Cloud Sync scope, I would compare the on-premises UPN, primary SMTP address, proxy addresses and existing Entra account. Also confirm that the cloud account is not already controlled by another synchronization engine.
For a controlled migration, use the source anchor or onPremisesImmutableId to hard-match the existing Entra account instead of relying only on soft matching.
I would start with two or three test users in a separate OU. If a duplicate account has already been created, pause synchronization for that user before deleting or changing anything, especially when a mailbox and licences are attached.
It was the syncd account that was in the deleted users that was causing a conflict. I deleted that and I was able to copy the onPremisesImmutableId to the Azure/Entra account.
the OnPremisesImmutableId on premise and in Azure match. Its still not syncing.
