Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
AD to Entra Cloud Sync Issues with Attributes
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous
We have run into an issue with AD to Entra Cloud Sync deployment, where the proxyAddress attributes appear to not match between on premises AD and Entra. However, in the on premises AD there is no SMTP value assigned at all.
Below is the error we are receiving.
“Error code
AzureDirectoryServiceAttributeValueMustBeUnique
Error message
An attribute value violates a uniqueness constraint. Please study the values of the attributes, comparing them the attributes of already-existing objects in Azure Active Directory and resolve the conflict by modifying the value in the source directory. Additional Details: Unable to update this object because the following attributes associated with this object have values that may already be associated with another object in your local directory services: [ProxyAddresses ;]. Correct or remove the duplicate values in your local directory. Please refer to http://support.microsoft.com/kb/2647098 for more information on identifying objects with duplicate attribute values. ObjectId: randomidstring ObjectIdInConflict: randomclonflictid AttributeConflictName: ProxyAddresses AttributeConflictValues: SMTP:useremail@example.com”
Not sure how to correct this, support suggested deleting the Entra user entirely and allowing AD to provision, but I do not want to remove all our users and re-add. There should be a simple way to sync without having to remove users.
Thanks in advance! (note - I realize I may have posted this in the wrong place. There does not seem to be an Entra option for community posts?)
Microsoft Security | Microsoft Entra | Microsoft Entra ID
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 85%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVS%3C/text%3E%3C/svg%3E)
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator2026-02-26T19:33:48.9566667+00:00 Hello Matthew Banks,
This error is expected behavior with Microsoft Entra Cloud Sync and is not caused by your on‑prem AD missing the SMTP value.
Why this happens
Even though the on‑prem AD user does not currently have an SMTP value in
proxyAddresses, another object already exists in Microsoft Entra ID that owns:SMTP:useremail@example.comproxyAddressesmust be globally unique across the entire Entra tenant. Cloud Sync blocks the update because Entra detects that this SMTP address is already associated with a different object (active user, guest user, or even a soft‑deleted user).This is why the error points to Entra ID, not on‑prem AD.
Do you need to delete and re‑create users?
No deleting and re‑adding users is not required.
Support’s suggestion works, but it’s not the only or recommended approach in most cases.
Recommended way to fix this (simple and safe)
- In the Microsoft Entra admin center, search for
useremail@example.com - Check all of the following:
- Active users
- Guest users
- Deleted users (very common cause)
- Identify the object already holding the SMTP address.
- Resolve the conflict by either:
- Removing or correcting the
proxyAddresses/mailattribute on that object, or- Permanently deleting a soft‑deleted user if it’s no longer needed
- Re‑run Entra Cloud Sync
- Removing or correcting the
- Guest users
- Active users
Once the duplicate SMTP value is cleared, the on‑prem AD user will sync successfully.
About using ImmutableID / deleting duplicates
Manually forcing a match using ImmutableID (by creating a duplicate, assigning ImmutableID, and deleting one object) does work, but this is considered a recovery workaround, not best practice. It introduces temporary duplicate users and manual changes that can be risky in production environments.
That approach should only be used if:
- The conflicting Entra object cannot be modified, and
- Soft‑matching is not possible
- In the Microsoft Entra admin center, search for
-
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator
2026-03-02T16:07:20.0466667+00:00 Matthew Banks I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.
-
Anonymous
2026-03-06T20:42:33.3633333+00:00 Hello,
This proxy address attribute in Entra - I am sure I am just overlooking it but I do not see how to set it. It shows in the Contact Information > Proxy addresses in Entra, but I cannot seem to edit it? Is it the contact information field?
-
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator
2026-03-12T11:54:27.95+00:00 Matthew Banks This is expected behavior and you’re not missing anything
The ProxyAddresses section you’re seeing in Contact information is read‑only by design in Microsoft Entra ID. Even though it’s visible in the portal, proxyAddresses cannot be edited directly in the Entra admin center UI, especially for synced or mail‑related objects.
The fields like Email and Other emails are different attributes and do not control the actual
proxyAddressesvalue that Cloud Sync uses.To resolve the conflict, the duplicate SMTP value must be removed from the authoritative source, for example:
- If the conflicting object is another cloud user, guest, or soft‑deleted user, remove the duplicate proxy address using PowerShell / Graph, or permanently delete the soft‑deleted object if it’s no longer needed.
- If the object is mail‑enabled, update or remove the address through Exchange Online.
- If this user is intended to be authoritative from on‑prem AD, explicitly populate the correct
proxyAddressesvalue on the AD user (Attribute Editor) and let Cloud Sync retry.
Once the duplicate SMTP value is cleared from the conflicting object, Entra Cloud Sync will complete successfully without deleting and recreating users.
If you want, let me know what type of object currently owns that SMTP address (cloud user, guest, deleted user, mailbox), and I can share the exact steps for that scenario.
-
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator
2026-03-13T08:03:20.8966667+00:00 Matthew Banks Could you review my previous comment and let me know if you need any more information or further assistance?
-
Raja Pothuraju 47,820 Reputation points Microsoft Employee Moderator2026-03-17T08:22:51.6866667+00:00 @Matthew Banks, Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.
-
Anonymous
2026-05-07T15:13:17.9066667+00:00 Hello,
Apologies for the long delay. I have had other pressing projects, and am now circling back to this.
- I have attempted explicitly populating the proxyAddress value in the user now in AD, and it still fails when provisioning to Entra with the exact same error
- It appears proxy addresses are read only and cannot be removed? https://learn.microsoft.com/en-us/answers/questions/1486800/edit-and-remove-the-extra-proxy-address-for-guest
- I cannot remove the address from Exchange online, only modify it to something else, which seems to defeat the purpose, see the attached picture
To be clear, we are just trying to sync existing on premises AD users accounts with their pre-existing Entra accounts so that the passwords are the same. Thanks.
-
Anonymous
2026-05-07T15:21:46.5233333+00:00 Additionally,
It seems like it is actually trying to create a new user, when it should just match the users, AD should take precidence, and then they synchronize. Or at least that is what the docs say.
-
Raja Pothuraju 47,820 Reputation points Microsoft Employee Moderator
2026-05-11T10:56:20.2766667+00:00 @Matthew Banks, Can you please check in On-prem AD if the users are having any value for
ms-ds-consistencyGUIDattribute? If users have these values in AD, clear thems-ds-consistencyGUIDattribute from the users in AD and do an on-demand provisioning in Cloud Sync for a single user to test.May I know the pre-existing Entra accounts are cloud only users or are those users synced to Cloud using Entra Connect Sync before?
-
Anonymous
2026-05-11T12:26:21.88+00:00 Hello @Anonymous
We are not utilizing the ms-ds-consistencyGUID attribute, that field is empty in on premises AD.
The pre-existing Entra accounts are mostly Cloud only, however, maybe 10 of them did use Entra Cloud sync years ago. We have around 40 users or so, so roughly 30 of them (including my test user) are cloud only.
-
Raja Pothuraju 47,820 Reputation points Microsoft Employee Moderator
2026-05-12T10:07:40.4833333+00:00 Hello @Matthew Banks,
Let's troubleshoot & fix your issue over call, please let me know your email address and available time to schedule team's meeting. Please share these details over private message.
-
Anonymous
2026-05-12T13:48:46.7033333+00:00 Hello @Raja Pothuraju
I believe only moderators can send private messages, please feel free to send me one, and I will provide my email and times I am available.
Thank you so much!
-
Raja Pothuraju 47,820 Reputation points Microsoft Employee Moderator
2026-05-13T10:28:10.5966667+00:00 @Matthew Banks, Thank you for your response.
Only Moderators and Original poster can send private message.
I have already initiated a private message, please check and share the required details.
Sign in to comment
Sign in to answer