TS-031: Duplicate Chloe Bennett account after Entra Connect pilot sync

Resolved a hybrid identity conflict where an existing cloud-only Chloe Bennett account did not join to the matching on-premises Active Directory identity during the Microsoft Entra Connect pilot.

Scenario

During the Microsoft Entra Connect hybrid identity pilot, Kate Jones synced successfully from on-premises Active Directory to Microsoft Entra ID. During validation, two Chloe Bennett accounts were identified: the existing production cloud account [email protected] and a newly synced duplicate account [email protected].

The target outcome was to keep the production account, remove the duplicate synced object, and allow the correct Chloe Bennett account to become the hybrid identity linked to the on-premises AD user.

Priority reasoning: Impact was set to 3 - Low because the issue affected one user account in a pilot. Urgency was set to 2 - Medium because the duplicate identity could cause access, licensing and sign-in confusion if left unresolved. Under the priority matrix, Low impact plus Medium urgency gives 4 - Low.

ServiceNow Ticket

The incident was aligned to the affected hybrid identity service for consistent service ownership and reporting:

ServiceNow incident INC0010074 opened for duplicate Chloe Bennett account after Microsoft Entra Connect pilot sync
Figure 1ServiceNow incident opened for a duplicate Chloe Bennett account identified after the Microsoft Entra Connect pilot sync.

Investigation

I confirmed that two Chloe Bennett accounts existed in Microsoft Entra ID. The production account [email protected] was still cloud-only, while the duplicate account [email protected] was synced from the on-premises domain.

Microsoft Entra users list showing cloud-only Chloe Bennett account and synced duplicate Chloe Bennett account
Figure 2Two Chloe Bennett accounts were present: the production cloud account was not synced, and the duplicate account was synced from corp.nietz.co.uk.

I then verified the on-premises AD account. The user logon name was already set to [email protected] and the pre-Windows 2000 logon name was CORP\c.bennett, so the visible UPN and SAM account name were not the cause of the mismatch.

Active Directory Users and Computers showing Chloe Bennett user logon name c.bennett at nietz.co.uk and SAM account c.bennett
Figure 3The on-premises AD Chloe Bennett account had the expected UPN and SAM account name.
PowerShell showing Set-ADSyncScheduler SyncCycleEnabled false and Get-ADSyncScheduler with SyncCycleEnabled false
Figure 4The Entra Connect scheduler was paused before remediation so the account state could be corrected cleanly.

To prevent further half-finished changes while troubleshooting the hybrid identity issue, I temporarily paused the Entra Connect sync scheduler.

The key finding was that the production cloud account had Microsoft Entra administrative role assignments. Chloe Bennett had Service Support Administrator assigned directly and Helpdesk Administrator through the CLOUD_Helpdesk_UserAdmins group. That explained why the existing privileged cloud account needed to be cleaned up before attempting the soft-match again.

Microsoft Entra assigned roles page showing Chloe Bennett with Helpdesk Administrator and Service Support Administrator roles
Figure 5The production Chloe Bennett account had administrative roles before the soft-match remediation.
Microsoft Entra assigned roles page showing no directory roles assigned for Chloe Bennett
Figure 6The production Chloe Bennett account showed no directory roles assigned before the soft-match remediation continued.
Active Directory Users and Computers showing Kate Jones remaining in the Hybrid Pilot Users OU after Chloe Bennett was moved out of scope
Figure 7Chloe Bennett was moved out of the synced users OU, leaving only Kate Jones in the Hybrid Pilot users scope.
PowerShell showing Set-ADSyncScheduler SyncCycleEnabled true and Start-ADSyncSyncCycle PolicyType Delta success
Figure 8A delta sync was run after removing Chloe Bennett from the synced OU scope.
Microsoft Entra users list showing only one active Chloe Bennett account after duplicate removal
Figure 9The duplicate account was no longer visible in active users after it was removed from sync scope.

Fix Applied

I removed the administrative role assignments from the production cloud account before retrying the join. This reduced the risk of a privileged cloud-only identity being joined incorrectly while the duplicate synced object still existed.

I moved the on-premises Chloe Bennett account out of the synced Hybrid Pilot users OU. This removed the synced duplicate object from scope so Entra Connect could remove it from active users.

I re-enabled the scheduler and ran a delta sync so Entra Connect could process the scope change.

After the sync, only the production Chloe Bennett account remained in active users. The duplicate synced account had been removed from the active users list.

I then selected the deleted duplicate account for permanent deletion. This cleared the conflicting duplicate object before the on-premises Chloe Bennett account was placed back into sync scope.

Microsoft Entra Deleted users page showing the deleted Chloe Bennett duplicate selected for permanent deletion
Figure 10The deleted duplicate Chloe Bennett account was selected for permanent deletion from Deleted users.
Active Directory Users and Computers showing Chloe Bennett and Kate Jones in the Hybrid Pilot Users OU
Figure 11Chloe Bennett was moved back into the synced Hybrid Pilot users OU after the duplicate was cleared.
PowerShell showing Start-ADSyncSyncCycle PolicyType Delta success after soft-match remediation
Figure 12A second delta sync was run after the soft-match remediation steps were completed.

With the duplicate object removed, I moved the on-premises Chloe Bennett account back into the Hybrid Pilot users OU.

I ran another delta sync to process the corrected account state and allow the existing production cloud account to join to the on-premises AD object.

Validation

I validated the result in Microsoft Entra ID. Only one Chloe Bennett account remained, the user principal name was [email protected], on-premises sync was enabled, the SAM account was c.bennett, and the on-premises domain was corp.nietz.co.uk.

Microsoft Entra users list showing one Chloe Bennett account with on-premises sync enabled and SAM account c.bennett
Figure 13The production Chloe Bennett account was successfully linked to the on-premises AD account and showed On-premises sync enabled: Yes.

After confirming the identity issue was resolved, I restored the intended helpdesk admin group membership so the production account had the required access again.

Microsoft Entra group CLOUD Helpdesk UserAdmins members showing Chloe Bennett and Daniel Smith
Figure 14The CLOUD_Helpdesk_UserAdmins group membership was restored after the identity was corrected.

Resolution

The ServiceNow incident was resolved after the duplicate identity was removed, the production account was confirmed as the synchronized account, and the required group membership was restored.

ServiceNow incident INC0010074 showing resolved state after Chloe Bennett duplicate identity remediation
Figure 15Incident INC0010074 was resolved after the duplicate Chloe Bennett account was remediated and the production account was validated.

Summary

  • Resolved a P4 Low Microsoft Entra ID incident involving a duplicate Chloe Bennett account after the pilot sync.
  • I confirmed the production cloud account and the duplicate synced account in Microsoft Entra ID.
  • I verified the on-premises AD account UPN and SAM account name before making changes.
  • I paused the Entra Connect scheduler to prevent further automatic sync changes during remediation.
  • I identified administrative role assignments on the production cloud account as the key blocker to a clean soft-match.
  • I removed the admin role assignments, removed the duplicate from sync scope, and cleared the deleted duplicate account.
  • I moved the on-premises account back into the synced OU and ran a delta sync.
  • I validated that the production account [email protected] became the synchronized identity.
  • I restored the intended helpdesk admin group membership and resolved the ServiceNow incident.
← Previous TicketBack to Service DeskNext Ticket →