Forum Discussion

tjcooper2's avatar
tjcooper2
Copper Contributor
Jul 09, 2026
Solved

Using Cloud sync to sync AD to existing Entra Accounts

I want to sync in premise AD accounts with existing Entra accounts. The email on both accounts is the same, and I added the Entra/o365 suffix to the domain and set the UPN to that suffix, making both...
Active Directory
Identity Management
microsoft 365
microsoft entra
  • Jamony's avatar
    Jamony
    Jul 10, 2026

    Hi, matching only by email address can unfortunately be unreliable.

    Before bringing the users into the Cloud Sync scope, I would compare the on-premises UPN, primary SMTP address, proxy addresses and existing Entra account. Also confirm that the cloud account is not already controlled by another synchronization engine.

    For a controlled migration, use the source anchor or onPremisesImmutableId to hard-match the existing Entra account instead of relying only on soft matching.

    I would start with two or three test users in a separate OU. If a duplicate account has already been created, pause synchronization for that user before deleting or changing anything, especially when a mailbox and licences are attached.

tjcooper2's avatar
tjcooper2
Copper Contributor
Jul 10, 2026

Well, it was a disaster. I setup up a filter and the sync process was creating a new account (due to roles). I then changed the filter and it deleted everything. I removed the configuration and restored the accounts.

I then removed the roles on my test account (mine), then setup the configuration again with the filter pointing a test OU again, and now it won't sync as it recognizes there is an existing Entra account with conflicting attributes.

UPN, SMTP are the same in Entra and in AD.