Ten things that break on the first sync from Active Directory to Entra ID

Commands are examples for a domain called contoso.local moving to contoso.com. Run them with -WhatIf first and pilot a small group.

1. Sign-in names on an internal domain

Users whose sign-in name (UPN) ends in .local, .lan, .corp or another domain the internet doesn't know sync with a generated name like jsmith@contoso.onmicrosoft.com. Their sign-in name changes without warning.

Fix: Add your email domain as a UPN suffix, then change UPNs to match email addresses. Pilot a group first.

Get-ADForest | Set-ADForest -UPNSuffixes @{Add='contoso.com'}
Get-ADUser -Filter "UserPrincipalName -like '*@contoso.local'" |
  ForEach-Object { Set-ADUser $_ -UserPrincipalName ($_.UserPrincipalName -replace '@contoso\.local$','@contoso.com') -WhatIf }

2. A domain that isn't verified in Microsoft 365

A real domain that hasn't been added and verified in the tenant has the same effect: the account syncs with an onmicrosoft.com name.

Fix: Verify the domain in the Microsoft 365 admin center (Settings > Domains) before the first sync.

3. Characters Entra rejects

Spaces, accented letters and characters such as \ % & * + / = ? { } | < > ( ) ; : , [ ] " in a UPN, or a UPN longer than 113 characters, are replaced with an onmicrosoft.com name.

Fix: Correct each UPN and tell the person their new sign-in name.

4. The same address on two accounts

Every UPN, mail address and email alias must be unique. The second account fails to sync (AttributeValueMustBeUnique), or links to the wrong cloud account.

Fix: Find who holds each address, decide the rightful owner, and remove it from the rest.

Get-ADObject -LDAPFilter "(|(mail=jane@contoso.com)(proxyAddresses=smtp:jane@contoso.com))" -Properties mail,proxyAddresses

5. An AD account that matches a cloud admin

Entra Connect will not link an AD user to a cloud account that holds an admin role. That user fails to sync until it is fixed.

Fix: Keep admin accounts cloud-only and separate, or remove the role before the first sync and add it back after.

6. A reused address that hands over someone else's mailbox

Sync links accounts by UPN or email, not by name. If a new employee was given a former employee's address, the new person takes over the old person's cloud mailbox, OneDrive and chats.

Fix: Compare names on every predicted link. Where they differ, confirm with HR before the sync.

7. One person, two cloud accounts

When the AD account and an existing cloud account share a name but neither the UPN nor the email matches, sync creates a second account and the person loses their mailbox.

Fix: Make the AD UPN or primary email match the existing cloud account so they link.

8. Accounts nobody should sync

Service accounts, disabled and stale accounts and on-premises admin accounts create cloud accounts nobody needs and attackers can use.

Fix: Move them to an OU that Entra Connect doesn't sync, and give admins separate cloud-only admin accounts.

9. An HR list that doesn't match the directory

HR knows people as TOD BREWER and CHRIS DAVIS; AD knows Todd Brewer and two Davises. Matching by hand takes days for a few hundred people.

Fix: Match on employee ID or email first, then names, and have a person decide only the doubtful rows.

10. An Entra Connect server that will stop syncing

From April 7, 2027 Entra Connect Sync must be version 2.6.84.0 or later and use application-based authentication.

Fix: Install a current version before the first sync, and check existing sync servers now.

Before you turn on sync

1. Fix the High findings: internal domains, duplicates, admin conflicts, reused addresses.
2. Decide the sync scope: which OUs, which accounts.
3. Tell people about sign-in name changes a week ahead.
4. Run the readiness check again. Turn on sync when it shows no High findings.