Using Cloud sync to sync AD to existing Entra Accounts

Hi, matching only by email address can unfortunately be unreliable.

Before bringing the users into the Cloud Sync scope, I would compare the on-premises UPN, primary SMTP address, proxy addresses and existing Entra account. Also confirm that the cloud account is not already controlled by another synchronization engine.

For a controlled migration, use the source anchor or onPremisesImmutableId to hard-match the existing Entra account instead of relying only on soft matching.

I would start with two or three test users in a separate OU. If a duplicate account has already been created, pause synchronization for that user before deleting or changing anything, especially when a mailbox and licences are attached.