Office365 Dirsync Error

[Blue_Cookeh]

Hi Guys,

 

I made some changes to our proxyAddress attribute in AD a week or so ago to make sure every user had their jbloggs and joe.bloggs e-mail addresses for Office365 and now I'm receiving this error for two of our users. Has anyone got any ideas as to how I can track the cause down? The user's accounts are now 'In cloud' on the Office365 admin panel, too. I can't see any conflicting settings in our AD...

 

Unable to update this object because the following attributes associated with this object have values that may already be associated with another object in your local directory services: [ProxyAddresses SMTP:[email protected];]. Correct or remove the duplicate values in your local directory. Please refer to http://support.microsoft.com/kb/2647098 for more information on identifying objects with duplicate attribute values.

 

The idFix tool on the Microsoft support page showed nothing wrong

 

Thanks!

Edited August 14, 2014 by Blue_Cookeh

[Davit2005]

In AD Users and computers check that you have no one else with the same proxy address, you could do this with an AD query and add the Proxy Address Column in and do a visual scan.

[Haptic]

If the Cloud account and the AD account are not showing “synchronized” it is probable that they have stopped synching because the proxy attributes are no longer matching.

 

Check to see if these two users have any old mail attributes that could be confusing things. Check that you have the correct SMTP primary addresses listed in the local directory and in the Exchange mailbox for each miss matched account. Making sure that your SMTP primary is in capital in AD and the correct Primary is set in Exchange.

 

Then rerun Dirsync if you had to make changes. This MAY allow the system to soft match on the SMTP addresses of the users.

 

It is unlikely to match and if it doesn’t then it is likely that the AD and WAAD accounts have conflicting a GUID/ImmutableID.You will need to take the GUID convert it to an immutableID and set the immutableID in WAAD for the affected UPN using the script below in the Azure Powershell tool.

 

Set-MsolUser -UserPrincipalName [email protected] -ImmutableId [ENTER IMMUTABLEid HERE]

 

Good Luck!

 

Andy

Edited August 15, 2014 by Haptic

[boostbar9]

its the same with me : /

[Blue_Cookeh]

If the Cloud account and the AD account are not showing “synchronized” it is probable that they have stopped synching because the proxy attributes are no longer matching.

 

Check to see if these two users have any old mail attributes that could be confusing things. Check that you have the correct SMTP primary addresses listed in the local directory and in the Exchange mailbox for each miss matched account. Making sure that your SMTP primary is in capital in AD and the correct Primary is set in Exchange.

 

Then rerun Dirsync if you had to make changes. This MAY allow the system to soft match on the SMTP addresses of the users.

 

It is unlikely to match and if it doesn’t then it is likely that the AD and WAAD accounts have conflicting a GUID/ImmutableID.You will need to take the GUID convert it to an immutableID and set the immutableID in WAAD for the affected UPN using the script below in the Azure Powershell tool.

 

Set-MsolUser -UserPrincipalName [email protected] -ImmutableId [ENTER IMMUTABLEid HERE]

 

Good Luck!

 

Andy

 

Brilliant, you got me on the right track!

 

- Firstly I had to stop the link between on premises and Office365 AD accounts using the Forefront Identity Mgmt client to enable deletion

- Then I had to force a full export into Office365 from the FIM client

- The account changed to 'In cloud'

- I could then use Powershell to delete the account and remove it from the Recycle Bin on Office365 (otherwise the account still exists and you get immutableID non-unique errors later)

- I then changed the "real" 'In cloud' user's immutableID to be the same as our on premises user

- I forced a full synchronisation with Powershell and start-onlinecoexistencesync

 

That's the two affected accounts now working perfectly and sync'd back to AD, thanks!

Edited August 22, 2014 by Blue_Cookeh

[Haptic]

Good Effort! That would work as a means to an end! There are a few risks in doing it that way that the less enlightened might trip over.

The major one is if you remove the Exchange licence from an account you delete the mailbox.