AD Connext & Azure sync errors

[mdrabble]

For some unknown reason we suddenly had hundreds of aD/Azure sync errors.

 

We do use salamander to create users and groups - so I don’t know if when I deleted old user and new users being created by salamander has something to do with it.

 

Not fully looked at what the errors are as only just seen the email from Microsoft

 

Any info welcome

 

Cheers

[Roberto]

For some unknown reason we suddenly had hundreds of aD/Azure sync errors.

 

We do use salamander to create users and groups - so I don’t know if when I deleted old user and new users being created by salamander has something to do with it.

 

Not fully looked at what the errors are as only just seen the email from Microsoft

 

Any info welcome

 

Cheers

 

Any advice or info does rather depend on what the errors actually are. Off the top of my head, as you mentioned deleting users, there is a deletion threshold setting in AD Connect that’s designed to prevent accidental changes removing all your Azure AD/O365 accounts. If the error talks about deletion thresholds, have a look at https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-feature-prevent-accidental-deletes

Edited September 4, 2020 by Roberto

[HPlum78]

yeah need to see what the MA's in the sync engine are saying on your AAD connect server, also would be handy to post the version number on AADC an all.

[mdrabble]

Office 365 Health showing as Ok

But when I look at Azure AD I have sync errors.

 

ADD Connect is 1.4.18.0 - Just updated to version 1.5.45.0

 

All errors are related to AttributeValueMustBeUnique

 

 

Unable to update this object because the following attributes associated with this object have values that may already be associated with another object in your local directory services: [ProxyAddresses SMTP:[email protected],smtp:[email protected];].  Correct or remove the duplicate values in your local directory.  Please refer to http://support.microsoft.com/kb/2647098 for more information on identifying objects with duplicate attribute values.
 

Tracking Id: 6cbcb6bf-2c9a-4604-b289-409dac3093da

ExtraErrorDetails:

[{"Key":"ObjectIdInConflict","Value":["5c001f4d-8c54-4be8-8e74-cef314668716"]},{"Key":"AttributeConflictName","Value":["ProxyAddresses"]},{"Key":"AttributeConflictValues","Value":["SMTP:[email protected]"]}]

[code]
 

I am assuming it is because class codes have been reused withing SIMS and at the end of the year Salamanader has removed the groups, re-added them and then populated them again.
 

Similar issues relating to students who were made leavers in Year 11 and then readmitted in Year12
 

If I open ADD Sync Service and open one of the error, click on the preview followed by Generate Preview and the Commit preview - that option show all ok - by ADD Sync and Azure still show as errors.
 
 

Is there a way I can get Azure to accept all settings from my Local AD even if it things the ProxyAddress is duplicated?
 

Chers

Edited September 4, 2020 by mdrabble
update ADSync

[HPlum78]

Yeah this is where you should not reuse identities on small scales and isolated environments this practices is ok(ish) but when you scale up or start syncing them it becomes more of an issue MS best practice is to not reuse, not unfixable but certainly will cause more pain than you need! I know this from my FIM/ MIM experience and the AADC sync is essentially MIM.

 

So that's the long answer the short answer is no! You need to sort the duplicate issues out. Then you need to solve the recreation rather than migration of users up a year group with out recreating all the groups don't know salamander tho, like I say I am a MIM man.

Edited September 4, 2020 by HPlum78

[3s-gtech]

Salamander won’t get involved, as long as the usernames stay the same and the kids have stayed on roll. It didn’t delete all of our year 11s when they left - just disabled their accounts ready to be re-enabled for year 12.

 

You have duplicate email addresses for multiple users it seems.

[mdrabble]

Yep having checked, when I removed the old users - I forgot they stayed in the Office 365 recycle bin for 30 days which is what has caused the problem.

 

Some of the group names have stayed the same which has never caused an issue before.

 

Not Salamanders fault in any way shape or form - think it a combo of me and Offjce 365 getting things out of sync.

 

May need to check the other areas of Office 365 for recycle bin areas such as users.

 

Least I now know it of my own making!!