We use one-way hybrid synchronization from on-premises Active Directory to Entra ID. Most users sync normally, but several recently offboarded accounts are failing to receive changes from AD. Our offboarding process disables the account and updates roughly six attributes, including manager, display name, and group membership. We have not changed this process recently, and none of those attributes should affect the user's identity or sign-in information.
I have tried both delta and initial synchronization cycles, checked the synchronization application, and verified that mS-DS-ConsistencyGuid matches between AD and Entra. I also created a new test account, synchronized it, and then offboarded it using the same process; that account updated successfully. An older, rarely used account also offboarded without problems.
The affected objects report a Data Validation Failure with this message: "Unable to update this object because the following attributes associated with this object are not allowed to be updated by your on-premises directory: [OnPremisesObjectIdentifier cannot be changed unless its current value is null]."
I also noticed Entra audit logs showing Office 365 SharePoint Online making changes to some affected users more than a day after they were disabled in both AD and Entra. Could those changes be related to the synchronization failures, or should I focus on something else? What should I check next?
3 Answers
I would start in the synchronization service manager and inspect one failing user from the Operations, Connector Space, and Metaverse views. Look for a join or projection problem, a duplicate object, a filtered object, or a pending export that contains a change to the immutable identifier. The directory synchronization error details in the tenant should identify the exact object and attribute involved.
Since a newly created test account works, this is more likely limited to the history or state of those particular users than to the offboarding procedure or scheduler. Check whether they were restored, recreated, moved between OUs, migrated, or previously represented by another cloud object.
The SharePoint audit entry may be incidental. Microsoft 365 services can update cloud-side metadata or activity-related properties, but that should not normally change the on-premises source anchor or cause AD Connect to replace OnPremisesObjectIdentifier. Check the audit event’s exact operation and property changes, but don’t assume SharePoint is the root cause unless it shows that identity attribute being modified.
Also avoid manually changing the immutable identifier in Entra as a first fix. Determine which object AD Connect is exporting and why its source-anchor value differs from the existing cloud object before considering any repair.
The important part of the error is not the manager, display name, or group changes—it is OnPremisesObjectIdentifier. Entra believes that immutable on-premises identity value is being changed, and that attribute cannot normally be overwritten by synchronization once it has a value.
Compare the connector-space and metaverse values for an affected user, not just mS-DS-ConsistencyGuid in the directories. Check whether the object is being joined to a different connector object, whether it was deleted and recreated, or whether an attribute flow or rule is attempting to populate OnPremisesObjectIdentifier. Also verify the source anchor configuration and confirm that the affected accounts still have the same source-anchor value that was originally synchronized.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures