Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync

Symptoms to confirm

You get the directory synchronization error email, the Microsoft 365 admin center flags a sync problem, or a user tells you their account or new email address isn't in Entra ID.

Likely causes

• When Entra Connect adds a new object, Entra ID first tries a hard match on the sourceAnchor, which is the Base64 form of the user's ms-DS-ConsistencyGuid (or objectGUID in older configurations) and is stored in the cloud as ImmutableId. If nothing matches, it tries a soft match on the userPrincipalName or the primary SMTP address, meaning only the SMTP: entry in proxyAddresses.
• Most duplicate errors are therefore one of three stories: two Active Directory objects share an address or UPN, an object was recreated (or moved between forests) so its sourceAnchor changed while the old cloud object still exists, or a cloud-created object collides with a newly synced one.

Checklist

1. 1

   Find the error details

   The quickest view is the sync error report in Microsoft Entra Connect Health › Sync services.

2. 2

   Resolve duplicate values

   For AttributeValueMustBeUnique, InvalidSoftMatch and ObjectTypeMismatch, decide which object should keep the value, remove it from the other one in its source directory, and let the next delta cycle export the change. Run IdFix against Active Directory to find every duplicate, blank or malformed value in one pass instead of chasing them one at a time.

3. 3

   Make the right object match

   When the new on-premises object should take over an existing cloud user (a recreated account, a forest move, or a reinstalled Entra Connect with a different anchor), force a hard match by writing the cloud ImmutableId into the user's ms-DS-ConsistencyGuid:

   powershell

   Connect-MgGraph -Scopes "User.Read.All"
   $cloudUser = Get-MgUser -UserId "bob.taylor@contoso.com" -Property OnPremisesImmutableId
   $guid = [Guid][Convert]::FromBase64String($cloudUser.OnPremisesImmutableId)
   
   Set-ADUser -Identity bobt -Replace @{ 'mS-DS-ConsistencyGuid' = $guid.ToByteArray() }
   Start-ADSyncSyncCycle -PolicyType Delta

   Check the tenant's matching switches with the Microsoft Graph PowerShell SDK:

   powershell

   Connect-MgGraph -Scopes "OnPremDirectorySynchronization.Read.All"
   Get-MgDirectoryOnPremiseSynchronization | Select-Object -ExpandProperty Features | Format-List

4. 4

   Fix data validation and size errors

   Correct UPNs with unsupported characters or formats (IdFix flags them), and verify the UPN suffix as a domain in the tenant, otherwise the user lands on the onmicrosoft.com domain.

5. 5

   Find an object that never syncs

   • On the Entra Connect server, start the wizard and go to Additional Tasks › Troubleshoot › Launch, then choose Troubleshoot Object Synchronization. Give it the object's distinguished name, the AD connector name and Hybrid Identity Administrator credentials. It checks UPN mismatch, domain and OU filtering, linked mailboxes and dynamic distribution groups, and writes an HTML report.
   • Manually, open Synchronization Service Manager, select Connectors, the Active Directory connector and Search Connector Space. If the object is missing, it's outside domain or OU filtering: rerun the wizard and re-select the OU (a renamed OU drops out of scope silently).
   • If the object is in the connector space but Metaverse Search doesn't find it, a scoping filter stopped it. In the Synchronization Rules Editor, compare the inbound rules' scoping filters with the object's attributes; isCriticalSystemObject and custom attribute filters are the usual culprits.
   • If it's in the metaverse but not in the Entra connector space, check the outbound rule scope and whether cloudFiltered is True.
6. 6

   Run the right sync cycle

   Delta syncs run every 30 minutes by default. Changing OU filtering needs a full import followed by a delta sync; changing attribute filtering needs a full synchronization. The simplest supported route is to put the server in staging mode and run:

   powershell

   Get-ADSyncScheduler
   Start-ADSyncSyncCycle -PolicyType Initial   # full import + full sync on all connectors
   Start-ADSyncSyncCycle -PolicyType Delta

Verify

• After the next export (and up to 30 minutes for Connect Health to refresh), the object no longer appears in the error report and the Operations tab shows success for the Entra connector.
• In Entra ID › Users, the user shows On-premises sync enabled: Yes with the expected UPN and addresses, and the metaverse object lists both the Active Directory and Entra connectors on its Connectors tab.
• For a forced hard match, confirm the cloud user kept its licences, mailbox and group memberships.

Prevent it next time

• Clean Active Directory with IdFix before onboarding new domains, and keep ms-DS-ConsistencyGuid as the source anchor so account recreations don't orphan cloud objects.
• Don't create cloud-only users for people who exist in Active Directory; let synchronization create them.
• Install the Connect Health agent and watch the error report and alerts rather than waiting for the notification email.
• Consider Microsoft Entra Cloud Sync for new environments: lightweight provisioning agents, configuration stored in the cloud, multiple agents for high availability and support for disconnected forests. It's Microsoft's strategic direction for hybrid synchronization, but compare the feature list first, because not every Connect Sync capability is available yet.