Azure DevOps Graph resolves renamed B2B guest user to obsolete identity

Question

Azure DevOps Graph resolves renamed B2B guest user to obsolete identity

Ladislav Chlum (Admin) 0

We have an Azure DevOps organization named "axp".

A guest user from partner tenant ABC was renamed from:

******@ABC.com

to

******@ABC.com

Actions already performed:

Removed the original guest account from Entra ID.
Invited and recreated the guest user with the new email address.
Guest invitation has been accepted.
Azure DevOps user entitlement was removed and recreated.
Azure DevOps organization user was removed.

Current Entra ID guest account:

Display Name: Gisela Z

Email: ******@ABC.com

Object ID: PII

However Azure DevOps Graph still resolves the user as:

Display Name: Gisela J

Email: ******@ABC.com

Origin ID: PII

Descriptor: aad.YTpIIIw

Even after removing the user and inviting ******@ABC.com again, Azure DevOps automatically recreates the historical identity ******@ABC.com.

The user is unable to authenticate successfully.

Please verify whether the Azure DevOps Graph identity cache or descriptor mapping can be reset or removed.

Vallepu Venkateswarlu 10,260 Reputation points Microsoft External Staff Moderator

2026-07-03T10:29:22.8966667+00:00
Hi Ladislav Chlum (Admin),

Welcome to Microsoft Q&A Platform.

It looks like you’ve run through all the usual steps in Entra ID and in Azure DevOps, but DevOps is still hanging on to the old B2B guest descriptor.

Azure DevOps Services maintains its own Graph-identity cache for performance, and deleting & re-inviting a guest doesn’t immediately purge that cache it can take up to 24 hours to naturally expire, and there’s no customer-exposed “flush cache” switch right now.

Reset the guest’s redemption status in Entra ID instead of deleting+recreating

In the Microsoft Entra admin center (or via PowerShell/Graph), use the “Reset redemption status” feature to update the user’s sign-in email. That preserves the existing object ID, app assignments and group memberships, so Azure DevOps sees it as the same identity but with the new email.

Docs: Microsoft Entra → External ID → Reset redemption status for a guest user

Wait for the Azure DevOps Graph cache to refresh

Azure DevOps pulls identity details from Entra and caches them for a period (typically up to 24 hours). Once that TTL lapses, you should see the new display‐name/UPN flow through automatically without touching the user.

In the meantime, the old descriptor will still appear in Azure DevOps and continue to block sign-in.

References: Reset the redemption status for a guest user in Microsoft Entra External ID
Troubleshoot sign-in and connectivity in Azure DevOps

If the above steps did not help resolve your issue, please feel free to share the details in a private message so we can proceed with further troubleshooting over a Teams call. I am happy to connect with you on Teams to investigate and resolve the issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.

Your answer

Vallepu Venkateswarlu 10,260 Reputation points Microsoft External Staff Moderator

2026-07-03T10:29:22.8966667+00:00

Hi Ladislav Chlum (Admin),

Welcome to Microsoft Q&A Platform.

It looks like you’ve run through all the usual steps in Entra ID and in Azure DevOps, but DevOps is still hanging on to the old B2B guest descriptor.

Azure DevOps Services maintains its own Graph-identity cache for performance, and deleting & re-inviting a guest doesn’t immediately purge that cache it can take up to 24 hours to naturally expire, and there’s no customer-exposed “flush cache” switch right now.

Reset the guest’s redemption status in Entra ID instead of deleting+recreating

In the Microsoft Entra admin center (or via PowerShell/Graph), use the “Reset redemption status” feature to update the user’s sign-in email. That preserves the existing object ID, app assignments and group memberships, so Azure DevOps sees it as the same identity but with the new email.

Docs: Microsoft Entra → External ID → Reset redemption status for a guest user

Wait for the Azure DevOps Graph cache to refresh

Azure DevOps pulls identity details from Entra and caches them for a period (typically up to 24 hours). Once that TTL lapses, you should see the new display‐name/UPN flow through automatically without touching the user.

In the meantime, the old descriptor will still appear in Azure DevOps and continue to block sign-in.

References: Reset the redemption status for a guest user in Microsoft Entra External ID
Troubleshoot sign-in and connectivity in Azure DevOps

If the above steps did not help resolve your issue, please feel free to share the details in a private message so we can proceed with further troubleshooting over a Teams call. I am happy to connect with you on Teams to investigate and resolve the issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.