420 4.2.0 Transient Failure during recipients lookup AmbiguousRecipientTransientException

Hi all,

MS fixed the issue yesterday in our tenant.

Yes, it was a sync issue and they told me it is fixed.

They also removed the duplicate MailUsers.

From what they told, this shouldn't happen again. If you're in this situation though, unfortunately you still have to engage with MS to remove those duplicate MailUsers.

I hope, you all got it solved meanwhile!

Cheers, Alex

Good morning everyone,

Last night (well, my night), the MS support engineer sent a message, saying, the duplicates have been removed.

I verified that statement and yes, duplicates are gone an MailUsers without corresponding Azure object have been removed too.

Conclusion: if you stumble into this pit, you definitely need MS to get out. Well, at least for removing the duplicates.

However, they still owe me a root cause analysis.

If I get it, I'll let you know.

Cheers, Alex

This is my analysis of what might have happened.

The tenant already has a Group of guest users created sometime in the past. I can not determine if those users were also present in Entra, I am guessing they weren't.

My suspicion is that Microsoft has since changed how to construct the names of the guest users. Instead of just using an [uuid] they are now named [Guest_uuid] (see below).

A user within the tenant creates a new Group of guest users (for Christmas cards for example) and it doesn't work (I'm not sure what the exact errors were my client experienced). This new Group creates new [Guest_uuid] users in Entra and after sync also in EXO. EXO now contains duplicated entries for the same guest users, one with an [uuid] name and one with a [Guest_uuid] name.

The user now deletes the Group.

The group members are now moved to Deleted Users in Entra and a sync to EXO is started.

This synchronization with EXO fails because trying to delete an entry causes a conflict due to there being duplicate entries.

The end result is a list of group members with duplicate entries in EXO. Trying to email them fails because EXO doesn't know which of them to choose. Trying to delete them in the admin console or using Powershell doesn't work either.

Deleting the Deleted Users in Entra doesn't help because the sync to EXO doesn't work then either.

Only Microsoft can now delete these guest users in EXO.

This, for instance, was one of the duplicated Guest users in EXO of my client:

Get-MailUser -Identity "<guest user>" | Select-Object Name, Guid

Name                                   Guid

----                                   ----

Guest_537a867e5c26401294e0eb7dc6d5f884 624ed1d4-f653-4394-8ee7-3bd2a40f6703

537a867e-5c26-4012-94e0-eb7dc6d5f884   1cf13840-e6f9-46e0-aaf1-d3c48b50dfab

Ernst Mulder

I'd rather request them to provide message tracing results from their side "to be able to further troubleshoot"... ;-)

If they haven't got a "Send External" event in their results (but a "Fail" or "Defer" or similar), the message never left their system, hence not your problem. :-)

Pleasure to help!

Cheers!

Thanks Alex! I think I'll just ask the county to contact Microsoft since they are the sender. I can't help but feel like this is going to take months. First, I have to convince the county that the issue is on their side. THEN have them contact Microsoft to resolve it. Might be easier for me to just create an alias and be done with it. I think I read somewhere that works as a workaround.

Thanks again Alex. I really appreciate you!