Is onPremisesSamAccountName unique?

onPremisesSamAccountName is not guaranteed to be unique in Microsoft Entra ID (Azure AD). It is a synchronized on-premises attribute and can collide across domains or forests; therefore, it should not be treated as a unique key in the tenant.

For identifying the correct object when only on-premises attributes are available, Microsoft Entra ID uses the on-premises security identifier (onPremisesSecurityIdentifier) and related attributes as the authoritative identifiers for accessing on-premises resources. The documented set of relevant on-premises properties on a cloud user object includes:

1. onPremisesDistinguishedName
2. onPremisesDomainName
3. onPremisesSamAccountName
4. onPremisesSecurityIdentifier
5. onPremisesUserPrincipalName

These attributes are exposed on the Microsoft Graph user resource and, in the SCIM extension, via the urn:ietf:params:scim:schemas:extension:Microsoft:Entra:2.0:User namespace, where onPremisesSAMAccountName and onPremisesSecurityIdentifier are mapped directly to their Entra ID counterparts.

However, the provided context does not include a Graph query pattern that allows resolving onPremisesSecurityIdentifier from only onPremisesDomainName and onPremisesSamAccountName. It only documents that these attributes exist, how they map in SCIM, and that they can be maintained or cleared via Graph/PowerShell for specific users (for example, with Clear-ADSyncToolsOnPremisesAttribute or by manually maintaining them using Microsoft Graph after a source-of-authority transfer).

From the context, the supported operations are:

• Reading and maintaining onPremisesSamAccountName and related attributes on user/group objects (for example, via Microsoft Graph or SDKs such as MicrosoftGraphUserInner / MicrosoftGraphGroupInner).
• Clearing specific on-premises attributes (including onPremisesSamAccountName and onPremisesSecurityIdentifier) for a known user ID using Clear-ADSyncToolsOnPremisesAttribute.

The context does not provide a documented Graph filter or lookup that, given only onPremisesDomainName and onPremisesSamAccountName, returns the corresponding onPremisesSecurityIdentifier.

References:

• MicrosoftGraphUserInner Class
• MicrosoftGraphGroupInner Class
• Microsoft Entra ID SCIM API schema
• Clear on-premises attributes from migrated Microsoft Entra ID users
• Configure user Source of Authority (SOA)
• Microsoft Graph what's new history