Recently I was asked to troubleshoot a AAD Connect Sync issue. There were about 50 users account that were not syncing with a “AttributeValueMustBeUnique” error. Looking into the error the user ObjectID was conflicting with a device ObjectID. The user account was syncing from Active Directory and the device was an AAD Hybrid Joined machine. This was a new one for me.
Troubleshot Step 1:
The first troubleshooting step was to verify none of the accounts had Admin roles in AAD.
“An Existing Admin Role Conflict sync error occurs on a user object during synchronization when that user object has:
Azure AD Connect isn’t allowed to soft match a user object from on-premises AD with a user object in Azure AD that has an administrative role assigned to it. For more information, see Azure AD userPrincipalName population.”
Troubleshoot Step 2:
The next troubleshooting step is to use the “Apply Fix” in Azure AD Connect Health.
Diagnose and remediate duplicated attribute sync errors
Normally this will fix most errors, but the “Apply Fix” did not fix this issue.
Troubleshoot Step 3:
The next troubleshooting step is to do a quick soft match by UPN.
After waiting for AAD Connect sync to complete, I checked the Azure AD Connect health. The “AttributeValueMustBeUnique” error was still present for the user account.
Troubleshoot Step 4:
The next troubleshooting step was to try a soft match by email.
After waiting for AAD Connect sync to complete, the “AttributeValueMustBeUnique” error was still present for the user account.
Troubleshoot Step 5:
The next step was to try a hard match by forcing the connection of ObjectID with the ImmutableID with on-prem AD account and AAD account.
Still the “AttributeValueMustBeUnique” error was still present for the user account.
Troubleshoot Step 6:
The next troubleshooting step I tried was to find the conflicting device.
When I found the device, it showed two icons for the device. The first icon is the normal device icon that was Azure AD Hybrid Joined device indicator. The second icon indicates an autopilot device object and shows the machine as Azure AD Joined. This is by design. When you register a device with Windows Autopilot, an Azure AD device object will be created corresponding to that Azure AD device.
After digging into the issue more, I found the customer had a ransomware attack, with their entire network encrypted, which they had to restore the entire local domain with backup images. They originally deployed devices using Autopilot deployment profiles in Configuration Manger. After they restored the network, they did not bring back the Configuration Manager machine.
That device objects are important for Windows Autopilot and should never be deleted without also removing the Windows Autopilot device. To support that, the Azure AD team has added an additional validation that won’t allow you to delete a device object associated with Windows Autopilot.
If you try deleting autopilot device, you get the following errors:
“You cannot delete Windows Autopilot devices here”
“Your selection contains Windows Autopilot Devices. Unselect these devices to continue deleting any remaining selected devices. Click Cancel to return to the list of devices and keep the devices selected.”
The next step you would usually go to Microsoft Endpoint Admin, Devices, Windows, Windows Enrollment, Devices and delete the device from there. Because it was an Autopilot device from Configuration Manager it would delete the device, but not the Autopilot device object. The only option is to disable, but this would not resolve the conflicting ObjectID.
You can delete the device from the On-Prem AD, but it still will not delete the Autopilot device object which contains the conflicting ObjectID.
To completely remove the device from Azure AD along with the Autopilot device object we will need to delete from PowerShell in Microsoft Online (MSOL)
We hope this saves you time resolving this error in the future. If you have any questions regarding this process reach out to our team at info@eGroup-us.com to set up some time with one of our experts.