Duplicate user identity issue in DevOps

Hi @james scott

Thank you for reaching out to Microsoft Q&A

This is the known condition of Orphaned user in Azure DevOps.

In order to resolve this user, you will have to remove the old user that's in the Permissions list via azure cli command below:

az devops security group membership remove --group-id "$G" --member-id "$SUBJECT_DESCRIPTOR" 

#!/usr/bin/env bash
set -euo pipefail
ORG="xxxx"                   
PROJECT="xxxxx"           
PAT="xxxx"
USER_QUERY="<user-email-or-objectId"  
################################
# Helpers
b64() { printf :%s "$PAT" | base64; }
AUTH="Authorization: Basic $(b64)"
JSON="Content-Type: application/json"
echo "==> Setting az devops defaults"
az devops configure --defaults organization="https://dev.azure.com/$ORG" project="$PROJECT"
echo "==> Resolving user subjectDescriptor via Graph Subject Query"
SUBJECT_DESCRIPTOR=$(curl -sS -H "$AUTH" -H "$JSON" \
  -d "{\"query\":\"$USER_QUERY\",\"subjectKind\":\"User\"}" \
  "https://vssps.dev.azure.com/$ORG/_apis/graph/subjectquery?api-version=7.1-preview.1" \
  | jq -r '.value[0].descriptor')
if [[ -z "${SUBJECT_DESCRIPTOR}" || "${SUBJECT_DESCRIPTOR}" == "null" ]]; then
  echo "ERROR: Could not resolve subjectDescriptor for '$USER_QUERY'."
  echo "Tip: Try filterValue on Identities API or ensure PAT has Graph scope."
  exit 1
fi
echo "Subject descriptor: $SUBJECT_DESCRIPTOR"
echo "==> Listing all project security groups"
GROUPS=$(az devops security group list --project "$PROJECT" -o json | jq -r '.[].descriptor')
if [[ -z "$GROUPS" ]]; then
  echo "No groups found in project '$PROJECT'."
  exit 0
fi
FOUND_GROUPS=()
echo "==> Checking membership per group"
while IFS= read -r G; do
  MEMBERS=$(az devops security group membership list --id "$G" -o json | jq -r '.[].memberDescriptor' || true)
  if echo "$MEMBERS" | grep -Fxq "$SUBJECT_DESCRIPTOR"; then
    echo "FOUND: User is a member of group: $G"
    FOUND_GROUPS+=("$G")
  fi
done <<< "$GROUPS"
if (( ${#FOUND_GROUPS[@]} == 0 )); then
  echo "User is not a member of any project security group."
else
  echo "==> Removing user from found groups"
  for G in "${FOUND_GROUPS[@]}"; do
    echo "Removing $SUBJECT_DESCRIPTOR from $G ..."
    az devops security group membership remove --group-id "$G" --member-id "$SUBJECT_DESCRIPTOR"
  done
fi
echo "==> Optional: Remove from Teams (teams are graph groups under project scope)"
# Get project ID, then scope descriptor
PROJECT_ID=$(az devops project show --project "$PROJECT" -o json | jq -r '.id')
SCOPE_DESCRIPTOR=$(curl -sS -H "$AUTH" \
  "https://vssps.dev.azure.com/$ORG/_apis/graph/descriptors/$PROJECT_ID?api-version=7.1-preview.1" \
  | jq -r '.value')
if [[ -n "$SCOPE_DESCRIPTOR" && "$SCOPE_DESCRIPTOR" != "null" ]]; then
  TEAMS=$(curl -sS -H "$AUTH" \
    "https://vssps.dev.azure.com/$ORG/_apis/graph/groups?scopeDescriptor=$SCOPE_DESCRIPTOR&api-version=7.1-preview.1" \
    | jq -r '.value[].descriptor')
  TEAM_FOUND=()
  echo "==> Checking team memberships"
  while IFS= read -r T; do
    # Query upwards membership and check if containerDescriptor matches team
    MEMBERSHIPS=$(curl -sS -H "$AUTH" \
      "https://vssps.dev.azure.com/$ORG/_apis/graph/memberships/$SUBJECT_DESCRIPTOR?direction=up&api-version=7.1-preview.1")
    MATCH=$(echo "$MEMBERSHIPS" | jq -r --arg T "$T" '.value[]?.containerDescriptor' | grep -Fx "$T" || true)
    if [[ -n "$MATCH" ]]; then
      echo "FOUND: User is in team (graph group): $T"
      TEAM_FOUND+=("$T")
    fi
  done <<< "$TEAMS"
  if (( ${#TEAM_FOUND[@]} > 0 )); then
    echo "==> Removing from teams"
    for T in "${TEAM_FOUND[@]}"; do
      echo "Removing $SUBJECT_DESCRIPTOR from team/group $T ..."
      curl -sS -X DELETE -H "$AUTH" \
        "https://vssps.dev.azure.com/$ORG/_apis/graph/memberships/$SUBJECT_DESCRIPTOR/$T?api-version=7.1-preview.1" \
        >/dev/null
    done
  else
    echo "No team memberships found for the user."
  fi
else
  echo "Could not resolve project scope descriptor; skipping team cleanup."
fi
echo "==> Completed. Verify in Project Settings → Permissions / Teams."

You can also use below Rest API To remove the User from Permissions:

DELETE https://dev.azure.com/{organization}/_apis/permissions/{securityNamespaceId}/{permissions}?descriptor={descriptor}&api-version=7.1

https://learn.microsoft.com/en-us/rest/api/azure/devops/security/permissions/remove-permission?view=azure-devops-rest-7.1&tabs=HTTP

If both the email is still mapped to same user object, Repeat the same steps above for user with new email id. And remove the new user from Azure DevOps completely.

Once the user identity old and new is removed from Azure DevOps, Add the user again as new Entra User with correct email and UPN and re-add the newly created user in Azure DevOps.

This will keep the email and identity of user into the new user object and avoid the duplicate.

Hi @james scott

Can you check Pravallika's answer below and see if removing the old user from permissions help? or removing the old and new user object from devops and re-adding it helps resolve the duplication?

Hi Pravallika,

Thanks for your message, unfortunately I get an error trying to run the script:

==> Resolving user subjectDescriptor via Graph Subject Query

curl: (43) Failed sending HTTP POST request

I will provide some further information in private message.

Thanks for your help

James

Hello,

An engineer reached out over private message offering a teams call to diagnose this issue further.

However I have not heard from the engineer and the private message history has now been deleted.

Could you please provide an update.

Many thanks

James

Hi @James Scott

Are you still facing: ==> Resolving user subjectDescriptor via Graph Subject Query

curl: (43) Failed sending HTTP POST request

error with the code above?

This error means, the code was unable to find the subject identifier, Let me check and get back