Azure AD Connect - procedure to change source of anchor from ObjectSID to Ms-DS-ConsistencyGUID

New Contributor


We are an organization of + 1000 users with ADs (domain and subdomains) linked to Azure AD via Azure Ad Connect.


Currently the anchor source is ObjectSID, UPN = mail and Hybrid Exchange.


We would like to change it to MS-DS-ConsistencyGUID in order to be able to move objects easily between ADs without impacting the Azure AD accounts. (Or find a tested procedure)


We have found documentation about changing the anchor source for ObjectGUID attributes to MS-DS-ConsistencyGUID but not much for attributes other than ObjectGUID.


I have read and tested several ideas but nothing is 100% risk free.


For you, what is the best procedure to change this anchor source without loss of connection/identification for the end user (on Office 365 for example)?
BTW = Soft Delete is not an option unless we have no choice

4 Replies


The sourceAnchor attribute value cannot be changed after the object has been created in Azure AD and the identity is synchronized.

The sourceAnchor attribute can only be set during initial installation. If you rerun the installation wizard, this option is read-only. If you need to change this setting, then you must uninstall and reinstall. If the value for sourceAnchor is changed after the object has been exported to Azure AD, then Azure AD Connect sync throws an error and does not allow any more changes on that object before the issue has been fixed and the sourceAnchor is changed back in the source directory.


Please refer to MSDocument for details.

Exactly, in the end I opted for a re-match using a script to connect the Azure AD accounts with the newly created AD accounts.
This approach allowed me not to have to reinstall or to change the Azure AD connector and I had almost no downtime.
If you are interested in this solution please contact me for more details.

@GaetW Can you explain how you did this re-match with a script?  We have talked to MS in the past about changing the Source Anchor and they were unable to come up with any ideas other than rebuilding the entire Azure AD environment.