420 4.2.0 Transient Failure during recipients lookup AmbiguousRecipientTransientException

Hi all,

MS fixed the issue yesterday in our tenant.

Yes, it was a sync issue and they told me it is fixed.

They also removed the duplicate MailUsers.

From what they told, this shouldn't happen again. If you're in this situation though, unfortunately you still have to engage with MS to remove those duplicate MailUsers.

I hope, you all got it solved meanwhile!

Cheers, Alex

Good morning everyone,

Last night (well, my night), the MS support engineer sent a message, saying, the duplicates have been removed.

I verified that statement and yes, duplicates are gone an MailUsers without corresponding Azure object have been removed too.

Conclusion: if you stumble into this pit, you definitely need MS to get out. Well, at least for removing the duplicates.

However, they still owe me a root cause analysis.

If I get it, I'll let you know.

Cheers, Alex

I'd rather request them to provide message tracing results from their side "to be able to further troubleshoot"... ;-)

If they haven't got a "Send External" event in their results (but a "Fail" or "Defer" or similar), the message never left their system, hence not your problem. :-)

Pleasure to help!

Cheers!

Hi Mikee,

yes, indeed, to my best knowledge and from what I've seen in my client's system, the issue started at the creation of an M365 group and/or adding external recipients to that group.

The situation I've reconstructed in my old cerebral processing unit:

• a user (sender side) created a new M365 group
• one or more external recipients got added to that group
• that triggered the creation of a Guest user object in Azure AD
• as this one should be a recipient in a distribution group (which is a function of the M365 group), a sync is triggered from AAD to EXO directory, where a MailUser / GuestMailUser is created.

--> and here seems to be the point where the error happened. At this stage for one external e-mail address two MailUsers were created.

(Note: I did not reproduce my theory to avoid anything else to break in this system.)

On the other hand, removing the duplicate MailUsers doesn't work, because (again, to my best knowledge and from what I've tested in my client's system):

• Remove-MailUser <external e-mail address> fails, because there are 2 objects returned. Needs to be a unique identifier.
• Remove-MailUser <distinguishedname of 1st MailUser> obviously calls upon AAD to delete the AAD object, which in turn creates another call to ExO directory to remove the MailUser. The latter somehow fails, which results in the MailUsers are still present, though the corresponding AAD object was deleted.

-> It can be found in the "Deleted Users" in EntraID.

-> Unfortunately no other sync seem to happen.

-> Even purging the object from Deleted Users did not trigger a sync. The MailUsers just stay.

• Trying to remove a MailUser in another attempt immediately fails with an error, saying, there is no corresponding object in AAD.

At this point I had to engage the support contractor.

I hope I have been able to explain my experience clearly.

Cheers, Alex

@Alex. Thank you for clarifying this to me and taking the time to reply. I really appreciate it. I wrote the reply below to Vince and wonder if you have any input on this additional question?

While researching this, I'm seeing that this "could" be caused by someone on the sending side adding a user on the receiving side as a Microsoft Teams guest in an innocent attempt to have a meeting with them. Something went wrong somewhere in that process, and this is causing the duplicate...

What I'm wondering now is.... If my user (Sam on the receiving side) knows he had a Teams meeting with (Karen on the sender domain) on or about the day this started happening. Can we call up (Karen) and ask her to undo whatever she did to add Sam as a guest - will that possibly fix this.

If this is a possible solution, it seems like it would be faster than getting Microsoft involved.