I have an issue where the following happened in the below sequence (and verified a second time with a test account, and O365 tennant in example is mydomain.onmicrosoft.com):

  1. Email was created on Office 365 with an email testuser@mydomain.com
  2. Local AD account was created with a local UPN of @corp.mydomain.com of the AD (by mistake, we had also added mydomain.com to the UPNs but wrong one was selected).
  3. AD Sync ran and we could see a user testuser@mydomain.onmicrosoft.com listed (show Synced with Active Directory under Office 365 portal admin users list)
  4. We then change the UPN of the AD account to @mydomain.com
  5. We get the error for Dir Sync status of We detected a duplicate UserPrincipalName conflict on the value testuser@mydomain.com. All attribute values need to be unique across objects. To resolve this conflict, first determine which object should be using the conflicting value. Then, update or remove the conflicting value from the other object(s). This error was detected on 9/7/17 12:32 PM.

The lists are:

UserPrincipalName: testuser@mydomain.com
Last DirSync time:
Source anchor:
Source of authority:Cloud
Created on:9/7/17 3:49 PM

UserPrincipalName: testuser@mydomain.onmicrosoft.com (Modified automatically)
Last DirSync time:9/7/17 4:32 PM
Source anchor:+fWWJ+utoUS9xeB2ofeKew==
Source of authority:On-premises Active Directory
Created on:9/7/17 4:02 PM
Proxy addresses:

As per https://support.microsoft.com/en-us/help/2641663/how-to-use-smtp-matching-to-match-on-premises-user-accounts-to-office

I have followed the details here and set the local AD account email address under user profile to testuser@mydomain.com, set the UPN to mydomain.com, and also added the proxy address SMTP:testuser@mydomain.com under attributes tab of the user, but still get the same error.

Any ideas please how i can link the listed testuser@mydomain.onmicrosoft.com (AD account) to testuser@mydomain.com (Office 365 mailbox) ?


  • 1
    My question to you is: If you're using Azure AD Connect (or DirSync) to sync your on premises AD users to Office 365 then why are you creating users in Office 365? Was this supposed to be a cloud only user? – joeqwerty Sep 8 '17 at 13:06
  • Yes it started as someone with a mailbox only, they then needed an AD account (which was created second, with the wrong UPN, which was then changed to the correct UPN) – g18c Sep 8 '17 at 14:52

This issues may caused by that you have not add your domain to office 365.

First , we know that Office 365 uses the cloud-based user authentication service Azure Active Directory to manage users. Every Azure AD directory comes with an initial domain name in the form of domainname.onmicrosoft.com. The initial domain name cannot be changed or deleted, but you can add your corporate domain name to Azure AD as well.

For example, your organization probably has other domain names used to do business and users who sign in using your corporate domain name. Adding custom domain names to Azure AD allows you to assign user names in the directory that are familiar to your users, such as ‘alice@contoso.com.’ instead of 'alice@.onmicrosoft.com'. The process is simple:

  1. Add the custom domain name to your directory
  2. Add a DNS entry for the domain name at the domain name registrar
  3. Verify the custom domain name in Azure AD

You can add your domain in Office 365 portal just here:

enter image description here

If you plan to federate your on-premises Windows Server AD with Azure AD, then you need to select the I plan to configure this domain for single sign-on with my local Active Directory checkbox when you run the Azure AD Connect tool to synchronize your directories. You also need to register the same domain name you select for federating with your on-premises directory in the Azure AD Domain step in the wizard. You can see what that step in the wizard looks like in these instructions. If you do not have the Azure AD Connect tool, you can download it here.

More about how to add a domain and users to Office 365, refer to this official document.

  • Hi Wayne, thanks for the reply - 1000% both the original and test domain added fully to Office 365 and setup with all required DNS records. AD Connect is also running on our DCs. – g18c Sep 11 '17 at 13:52
  • HI,@g18c,before sync your new ad users which using your own domain to Azure AD, have you deleted the old synced ad user(testuser@mydomain.onmicrosoft.com)? – Wayne Yang Sep 13 '17 at 6:45
  • Hi, @g18c, Did add your domain to Office 365 before or after syncing your AD Users? If synced your AD users to office 365 and then add domain, the user's UPN would not change. Because they are keep connecting with each other. – Wayne Yang Sep 13 '17 at 6:58

Technically, if Azure AD Connect is setup properly it should not have synced a user with an invalid (corp.mydomain.com) UPN. You'll have to tell me someday how you forced that one to happen. Did you authorize corp.mydomain.com in Office 365 also?

However, now the on-premise user is tied to the cloud user through the Anchor/ImmutableID.

  • If it's OK, delete the on-premise user account and sync. This should delete the user account in the cloud.
  • Restore the deleted user account in the cloud. Now it is "Cloud Only"
  • Change the Office 365 user account to the new login/UPN/Primary SMTP and all.
  • Delete the cloud user's ImmutableID from Office 365 powershell: Set-MsolUser -UserPrincipalName <clouduserUPN> -ImmutableID $null
  • Create a new AD user account with the proper UPN and ProxyAddresses that now matches the Cloud user's UPN/Login.
  • Now Sync. Azure AD Connect will match the on-prem user to the cloud user and sync up.

If you can't delete the on-premise AD account at step 1, then filter the on-prem user in Azure AD Connect and Sync. This will delete the user account in Office 365 also so you can do step 2. Then remove the filter before the final sync.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.