Sample report. Every name, address and server in it is made up.All samplesGet early access

Entra sync readiness check

City of Example (sample) · example.test
As of November 3, 2026
54
Work needed
Score out of 100
3 High 4 Medium 3 Low

Checked 29 enabled user account(s) of 31 for what will break or change when this Active Directory starts syncing to Microsoft Entra ID (Microsoft 365). The Microsoft 365 tenant was included, so links to existing cloud accounts are predicted.

Staff list matching

11Matched
3Check
2Multiple
2Not found
0Skipped

Rows that need a person to decide (first 40; the full list with every attribute is in matches.csv):

RowName in listStatusFoundWhy
9TOD BREWERChecktbrewer (Todd Brewer)Possible: first name differs
10JOSH BENDORCheckjbendor (Joshua Bendor)Possible: first name differs
11CHRIS DAVISMultiple (2)cdavis (Christopher Davis)Possible: first name differs
11CHRIS DAVISMultiple (2)cdavis2 (Christine Davis)Possible: first name differs
12ADRIANNE GUITIERREZCheckagutierrez (Adrianne Gutierrez)Possible: last name spelling
13JESSICA VALENZUELA SANCHEZMultiple (2)jvs1 (Jessica Valenzuela Sanchez)Name
13JESSICA VALENZUELA SANCHEZMultiple (2)jvs2 (Jessica Valenzuela Sanchez)Name
16RAYMOND OKAFORNot found
17HELEN PRICHARDNot found

Cloud matching

High

AD users would link to cloud accounts that hold admin roles; Microsoft blocks this

Why it matters
Entra Connect is not allowed to link an AD user to a cloud account with an admin role (Existing Admin Role Conflict). That user fails to sync until it is fixed.
What to do
Keep admin accounts cloud-only and separate. Change the AD user's UPN and email aliases so they do not collide, or remove the role before the first sync and add it back after.
Found
  • cloudadmin would link to cleo@example.gov, which holds an admin role
How to fix it (about 15 minutes per account)
  1. Decide whether the cloud account is the person's daily account or a separate admin account.
  2. If separate: change the AD user's UPN so it does not equal the admin account.
  3. If it is their daily account: remove its admin roles, let the first sync link it, then add the roles back (Microsoft's documented fix).
Check it worked

After the first sync, the account shows "On-premises sync enabled: Yes" and the roles are back.

Undo

Not applicable.

Medium

People who would end up with two cloud accounts

Why it matters
The AD account and the cloud account have the same name but neither the UPN nor the email address matches, so sync creates a second account instead of linking. The person loses access to their mailbox and files in the original account.
What to do
Before the first sync, make the AD user's UPN (or primary email alias) equal the cloud account's UPN so the two link.
Found
  • ttran (ttran@example.test) and cloud account tina.tran@example.gov
How to fix it (about 5 minutes per person)
  1. Confirm the two accounts are the same person.
  2. Set the AD UPN to the cloud UPN, or add the cloud address as the primary SMTP alias in AD.
Commands (run with your own admin account)
Set-ADUser -Identity <AD account> -UserPrincipalName <cloud UPN>
Set-ADUser -Identity <AD account> -Add @{proxyAddresses="SMTP:<cloud address>"}
Check it worked

Run the readiness check again: the person shows "Will link".

Undo

Set the old UPN back.

Info

What the first sync will do

Why it matters
Check the new-account count against the number of people who already have Microsoft 365. If it is higher than expected, some people will get a second account.
What to do
Review matches.csv (when a staff list was supplied) and the duplicate-person and name-mismatch findings before turning sync on.
Found
  • 1 will link to an existing cloud account
  • 26 will create a new cloud account
  • 1 already synced
  • 1 blocked (admin role)
  • 2 cloud-only account(s) no AD user will link to (they stay cloud-only)

Sign-in names

High

Users sign in with an internal domain (such as .local) that Microsoft 365 cannot use

Why it matters
Entra can only use verified internet domains. These users would sync with an onmicrosoft.com sign-in name instead, so their sign-in name changes without warning.
What to do
Add the company's email domain as a UPN suffix in AD, then change these users' UPNs to it (usually to match their email address) before turning on sync.
Found
  • @example.local - 1 user(s), e.g. lortega
  • @example.test - 1 user(s), e.g. ttran
How to fix it (about 30 minutes, plus user communication)
  1. Make sure example.gov is added and verified in Microsoft 365 (admin center > Settings > Domains).
  2. Add it as an alternative UPN suffix in Active Directory Domains and Trusts, or with the first command below.
  3. Change the UPNs: run the second command with -WhatIf, check the output, then run it without -WhatIf. Do a pilot group first.
  4. Tell users their sign-in name is now their email address. Windows sign-in with DOMAIN\username keeps working.
Commands (run with your own admin account)
# Active Directory PowerShell, on a DC or with RSAT. Review with -WhatIf first, then remove -WhatIf.
Get-ADForest | Set-ADForest -UPNSuffixes @{Add='example.gov'}
Get-ADUser -Filter "UserPrincipalName -like '*@example.local'" | ForEach-Object { Set-ADUser $_ -UserPrincipalName ($_.UserPrincipalName -replace '@example\.local$', '@example.gov') -WhatIf }
Get-ADUser -Filter "UserPrincipalName -like '*@example.test'" | ForEach-Object { Set-ADUser $_ -UserPrincipalName ($_.UserPrincipalName -replace '@example\.test$', '@example.gov') -WhatIf }
Check it worked

Run the Entra readiness check again; this finding should be gone.

Undo

Run the same command with the two domains swapped.

Email to the client (edit before sending)
Subject: Your Microsoft 365 sign-in name is changing

As part of connecting your office network to Microsoft 365, 2 people will sign in with their email address instead of an internal name. Passwords don't change. We'll make the change on [DATE] and send each person a reminder.
Medium

Sign-in names Entra will reject or rewrite

Why it matters
A UPN with a rejected character, an accent or too many characters is replaced with an onmicrosoft.com name when it syncs.
What to do
Correct each UPN in AD. The commands below suggest a cleaned-up value; confirm each one before running.
Found
  • brian upton - brian upton@example.gov: contains a character Entra rejects
How to fix it (about 2 minutes per user)
  1. Check each suggested UPN does not already belong to someone else.
  2. Run the command, then tell the person their new sign-in name.
Commands (run with your own admin account)
# Active Directory PowerShell
Set-ADUser -Identity "brian upton" -UserPrincipalName "brianupton@example.gov"   # was brian upton@example.gov
Check it worked

Run the readiness check again.

Undo

Set-ADUser -Identity <user> -UserPrincipalName <old value>

Medium

Enabled users with no sign-in name (UPN) at all

Why it matters
Usually old accounts created before UPNs were set. They sync with a generated onmicrosoft.com name, or are better left out of sync.
What to do
Give each person a UPN on your email domain (usually their email address), or exclude the account from sync if nobody uses it. Service accounts are listed under Accounts to keep out of sync.
Found
  • nwhitfield
How to fix it (about 2 minutes per user)
  1. Decide for each account: real person (set a UPN) or unused (disable and exclude from sync).
Commands (run with your own admin account)
# Active Directory PowerShell
Set-ADUser -Identity "nwhitfield" -UserPrincipalName "nwhitfield@example.gov"
Check it worked

Get-ADUser <user> | Select-Object UserPrincipalName shows the new value.

Undo

Set-ADUser -Identity <user> -Clear userPrincipalName

Low

Users whose sign-in name differs from their email address

Why it matters
People are told to sign in with their email address. When the UPN differs, sign-in fails or they call the help desk. It's also the most common reason two accounts fail to link.
What to do
Microsoft recommends the UPN match the primary email address. Change the UPN (preferred) or note the exceptions.
Found
  • dprice - signs in as dprice@example.gov, email is shared@example.gov
  • dporter - signs in as dporter@example.gov, email is shared@example.gov
  • mmartinez - signs in as mmartinez@example.gov, email is mia.m@example.gov
How to fix it (about 2 minutes per user)
  1. Confirm the email address is the one the person uses, then set the UPN to it.
Commands (run with your own admin account)
# Active Directory PowerShell: set each UPN to the email address (review with -WhatIf first)
Get-ADUser -Filter "mail -like '*'" -Properties mail | Where-Object { $_.UserPrincipalName -ne $_.mail } | ForEach-Object { Set-ADUser $_ -UserPrincipalName $_.mail -WhatIf }
Check it worked

Run the readiness check again.

Undo

Set-ADUser -Identity <user> -UserPrincipalName <old value>

Duplicates

High

The same address belongs to more than one account

Why it matters
Entra requires every UPN, mail and proxy address to be unique. The second account fails to sync (AttributeValueMustBeUnique) or links to the wrong cloud account.
What to do
For each address, decide which account should keep it and remove it from the others.
Found
  • dandrews@example.gov - used by dandrews, preyes
  • shared@example.gov - used by dprice, dporter
How to fix it (about 5 minutes per address)
  1. For each address, find who holds it (first command), decide the rightful owner, and remove it from the rest (second command).
Commands (run with your own admin account)
# Active Directory PowerShell
Get-ADObject -LDAPFilter "(|(mail=dandrews@example.gov)(userPrincipalName=dandrews@example.gov)(proxyAddresses=smtp:dandrews@example.gov))" -Properties mail,userPrincipalName,proxyAddresses
Get-ADObject -LDAPFilter "(|(mail=shared@example.gov)(userPrincipalName=shared@example.gov)(proxyAddresses=smtp:shared@example.gov))" -Properties mail,userPrincipalName,proxyAddresses
Set-ADUser -Identity <account that should not have it> -Remove @{proxyAddresses="smtp:<address>"}   # or -Clear mail / a new -UserPrincipalName
Check it worked

The first command returns one account per address.

Undo

Set-ADUser -Identity <account> -Add @{proxyAddresses="smtp:<address>"}

Medium

Email aliases (proxy addresses) Entra will reject

Why it matters
An alias with a space, bracket or other rejected character stops that account from syncing.
What to do
Correct or remove each alias.
Found
  • brian upton - brian upton@example.gov
How to fix it (about 2 minutes per alias)
  1. Remove the bad alias, and add a corrected one if it is still needed.
Commands (run with your own admin account)
Set-ADUser -Identity <account> -Remove @{proxyAddresses="smtp:<bad alias>"}
Set-ADUser -Identity <account> -Add @{proxyAddresses="smtp:<corrected alias>"}
Check it worked

Run the readiness check again.

Undo

Add the original value back with -Add.

Low

Mail nicknames that start with a period

Why it matters
Entra rejects a mailNickname that starts with a period.
What to do
Remove the leading period.
Found
  • dnichols - mailNickname '.dnichols'
How to fix it (1 minute per user)
  1. Set the nickname without the leading period.
Commands (run with your own admin account)
Set-ADUser -Identity <account> -Replace @{mailNickname="<nickname without the period>"}
Check it worked

Run the readiness check again.

Undo

Set the old value back with -Replace.

Sync scope

Low

Accounts to keep out of sync

Why it matters
Syncing unused, service and admin accounts adds cloud accounts nobody needs and gives attackers more to aim at. Microsoft recommends keeping admin accounts cloud-only.
What to do
Move these accounts into an OU that Entra Connect does not sync (OU filtering), or delete the ones nobody uses.
Found
  • 2 disabled accounts; 1 enabled account with no sign-in for 90 days; 1 service account; 1 privileged (admin) account
  • Stale: skowalski
  • Service: svc_backup
  • Privileged: admin1
How to fix it (about 1 hour)
  1. Create an OU such as "Not synced".
  2. Move disabled, stale and service accounts there after confirming with the client.
  3. Give admins a separate cloud-only admin account instead of syncing their AD admin account.
  4. In Entra Connect, choose Domain and OU filtering and leave "Not synced" unticked.
Commands (run with your own admin account)
# Active Directory PowerShell: list them for review
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly | Select-Object SamAccountName, LastLogonDate
Get-ADUser -Filter "adminCount -eq 1" | Select-Object SamAccountName
Move-ADObject -Identity "<distinguished name>" -TargetPath "OU=Not synced,DC=<domain>,DC=<tld>"
Check it worked

In Entra Connect, the sync preview shows the OU excluded.

Undo

Move the object back to its original OU.

What was read

AreaResult
User detailsRead - 32 user object(s)

Read-only check. Nothing in Active Directory or Microsoft 365 was changed. AD Exit Planner 0.3.0.