How to resolve duplicate proxy address for object without Entra Connect

Hey! It sounds like you’re hitting duplicate proxy (SMTP) / UPN issues during sync, which prevents the user object from being provisioned/updated correctly—so you can’t assign the license yet.

Even if you can’t download Microsoft Entra Connect (the documentation here assumes you’re troubleshooting duplicate attributes that typically show up in sync), the key fix is the same: make sure the conflicting UPN or proxyAddress (SMTP) values are unique across the objects.

What to do to resolve the duplicate attribute / sync error

1) Identify the conflicting attribute value(s)

The errors you’ll typically see are along the lines of:

• 6941\AttributeValueMustBeUnique
• QuarantinedAttributeValueMustBeUnique (related to duplicate attribute resiliency)

These happen when there are duplicates in either:

• your on-prem AD DS (same UPN or SMTP/proxy on multiple objects), or
• Microsoft Entra ID already has an object that conflicts with what’s being synchronized (existing Entra object already “owns” the value).

2) Decide which object should keep the duplicated value

Once you find the conflicting value:

• If the conflicting objects should be the same person, you can use soft-match (to map/merge the intended match) as described in the troubleshooting guidance for duplicate attributes.
• If they are different users, then you should remove/change the duplicate UPN or SMTP proxy address on the object(s) that shouldn’t keep it, so the value becomes unique.

3) Correct the attribute in the right place

Per the guidance, you generally resolve this by one of these approaches:

• Remove/change the duplicate UPN or proxyAddress in AD DS (so sync no longer tries to export duplicates), or
• If the conflict is due to an existing conflicting object in Microsoft Entra ID, update/remove the conflicting attribute there (or soft-match if they should align), or
• If the conflicting object was created outside of directory sync, remove/change the conflicting attribute in Entra so it doesn’t block provisioning.

Where to view sync errors

You can review directory synchronization errors in the Microsoft 365 admin center:

• The report shows user objects that have these directory sync errors (it may not show conflicts involving groups/contacts).

If “duplicate attribute resiliency” is involved

The docs note:

• If duplicate attribute resiliency is enabled, Entra ID may quarantine the conflicting duplicate attribute instead of fully failing.
• If the attribute is required for provisioning (example given: UPN), Entra ID may assign a placeholder value.
• The resiliency process specifically handles UPN and SMTP ProxyAddress values.

Resources (for the exact duplicate-attribute scenario)

• Duplicate attributes prevent sync
• AttributeValueMustBeUnique error
• Guidance/videos for troubleshooting duplicate SMTP/proxy or UPN and for soft-match/hard-match

References

• Duplicate attributes prevent sync: https://docs.microsoft.com/microsoft-365/troubleshoot/active-directory/duplicate-attributes-prevent-dirsync
• AttributeValueMustBeUnique (duplicate attribute troubleshooting): https://docs.microsoft.com/azure/active-directory/hybrid/tshoot-connect-sync-errors#fix-the-attributevaluemustbeunique-error
• Duplicate attribute resilience overview: https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-syncservice-duplicate-attribute-resiliency
• View directory synchronization errors in Microsoft 365: https://docs.microsoft.com/microsoft-365/enterprise/identify-directory-synchronization-errors?redirectSourcePath=%252farticle%252fIdentify-directory-synchronization-errors-in-Office-365-b4fc07a5-97ea-4ca6-9692-108acab74067&view=o365-worldwide
• Resolve Microsoft Entra Connect common object sync issues: https://supportabilityhub.microsoft.com/solutions/apollosolutions/9e9fc570-83fb-8d0f-e9ed-d5e817af0c79/cbd41f8b7-5c3c-ebc2aa59e3fe