AD account not syncing to AAD

Hello Chris Housden,

Thank you for posting your question in the Microsoft Q&A Forum.

This situation occurs when a Microsoft Entra ID (Azure AD) account was created in the cloud before the on-premises AD account existed. Even though the UPN and ImmutableId now match, Entra Connect won’t automatically merge them because the cloud account is considered authoritative.

What this means:

• The existing cloud account is “cloud-managed,” so the sync engine sees the on-prem account as a separate object.
• Matching UPN and ImmutableId alone doesn’t force a merge unless the account is in the correct state

The supported way to resolve this is by performing a Hard Match. Hard Match links the existing cloud-only account in Microsoft Entra ID to the on-premises Active Directory account by ensuring that the ImmutableId in Entra ID matches the on-premises sourceAnchor attribute (which is typically ms-DS-ConsistencyGuid or, if not customized, the objectGUID).

Once this match is established, Microsoft Entra Connect will recognize both as the same identity and convert the cloud account into a synchronized account.

For full details, refer to Microsoft’s official guidance:

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-existing-tenant

If this does not meet your situation, please let us know so that we can provide further assistance and ensure that your concerns are fully resolved. We are here to help you with any additional questions or issues.

Thank you, That page is where I started. I've ran various scripts to hard match but have had no luck. The AAD account still shows on-premises sync set to no. There is an on-premises ImmutableId listed just below that. The scripts aren't producing errors; they just aren't working.

If the scripts ran without errors but the account still shows “On-premises sync: No,” the hard match didn’t take effect. This usually happens for two main reasons:

1. Tenant takeover is blocked – The feature BlockCloudObjectTakeoverThroughHardMatchEnabled is enabled, so Entra ID refuses to convert the cloud account even if ImmutableId matches.
2. SourceAnchor mismatch – The cloud account’s ImmutableId was set from objectGUID, but Entra Connect is using ms-DS-ConsistencyGuid (or vice versa), so the join never happens.

Other causes can include the on-prem object being out of scope or duplicate UPN/SMTP conflicts.

Next steps:

1. Disable the takeover block: Turn off the feature BlockCloudObjectTakeoverThroughHardMatchEnabled if it’s enabled, because it prevents cloud accounts from being converted to synced accounts.
2. Align the ImmutableId: Make sure the cloud account’s ImmutableId matches the correct sourceAnchor that Entra Connect uses (usually ms-DS-ConsistencyGuid).
3. Run a full sync and verify: Start a full synchronization and check in Synchronization Service Manager that the object joins successfully and there are no conflicts like duplicate UPN or SMTP addresses.

Chris Housden I'm following up on my previous comment. Please let me know if you need any additional details or further clarification.