When syncing user accounts from Active Directory to Microsoft Entra ID (formerly Azure AD), you may encounter the “AttributeValueMustBeUnique” error. This issue typically occurs when user objects conflict with device objects due to improper sync configurations or conflicts in ObjectIDs. This post outlines troubleshooting steps to resolve the error and ensure smooth synchronization between Active Directory and Microsoft Entra ID.
Troubleshooting the “AttributeValueMustBeUnique” Error
Scenario: In this case, around 50 user accounts weren’t syncing, and the error pointed to conflicting ObjectIDs between user accounts and device objects. Specifically, a user account from Active Directory was syncing, while a Hybrid Joined device (from Microsoft Entra ID) had a conflicting ObjectID.
Here’s how to troubleshoot and resolve this issue effectively:
Step 1: Check for Admin Role Conflicts
Before diving deeper into object conflicts, check if any user accounts have admin roles assigned in Microsoft Entra ID. Admin roles can cause sync errors if the userPrincipalName (UPN) matches an existing Entra ID object with administrative roles.
- Admin Role Conflict: When a user has admin roles and the same UPN as an existing Entra ID object, Microsoft Entra ID Connect cannot soft match the user object.
To resolve this:
- Remove the admin roles for conflicting accounts in Microsoft Entra ID.
- Retry the sync process.
Step 2: Use "Apply Fix" in Microsoft Entra ID Connect Health
If step 1 doesn’t resolve the issue, use Microsoft Entra ID Connect Health to apply a fix for duplicate attribute errors.
- Open Azure Active Directory.
- Navigate to Microsoft Entra ID Connect > Connect Health.
- Select Sync Errors > Duplicate Attribute.
- Choose the affected user and click Troubleshoot.
- Click Apply Fix.
While this usually fixes most errors, it didn’t resolve the conflict in this case, so we proceeded with additional troubleshooting.
Step 3: Perform a Soft Match by UPN
Next, try performing a soft match by UPN to resolve synchronization issues:
- Move the Active Directory account to a non-syncing organizational unit (OU).
- Force a delta sync with the command:
Start-ADSyncSyncCycle -PolicyType Delta - Move the account back to the syncing OU.
- Force another delta sync.
After the sync completes, check Microsoft Entra ID Connect Health for any remaining errors. The conflict persisted.
Step 4: Soft Match by Email Address
Next, we attempted a soft match using the primary SMTP address of the user account.
- Verify the email address in Active Directory Users and Computers.
- Update the E-mail field and force a delta sync.
- Use Advanced Features to check UPN and proxy addresses.
Despite these updates, the “AttributeValueMustBeUnique” error persisted.
Step 5: Hard Match by ImmutableID
Now, we moved on to a hard match by ImmutableID to manually connect the on-prem AD and Microsoft Entra ID accounts.
- Retrieve the sourceAnchor (ImmutableID) from the CN link under Export Errors.
- Find the ObjectID for the affected user:
Get-MsolUser -UserPrincipalName "user.name@domain.com" | Fl *objectId* - Retrieve the ImmutableID using:
Get-AzureADUser -ObjectId “OBJECT ID” | FL *ImmutableID* - If the ImmutableID matches the sourceAnchor, run the command:
Set-AzureADUser -ObjectId "OBJECT ID" -ImmutableId SOURCEANCHOR_VALUE - Force a delta sync to check if the issue resolves.
Even after these changes, the error remained unresolved.
Step 6: Identify and Remove the Conflicting Device Object
Finally, the issue stemmed from a conflicting device object. After further investigation, we discovered the conflict was caused by a Windows Autopilot device object that was created during the Autopilot deployment using Configuration Manager. The Autopilot device object had an associated ObjectID that conflicted with the user account.
Steps to resolve:
Find the device in Microsoft Entra ID.
If it is a Windows Autopilot device, you’ll see two icons: one indicating a Hybrid Joined device and another showing an Autopilot device.
The issue arose when the customer’s network was restored after a ransomware attack without re-adding the Configuration Manager machine, which led to the device conflict.
Autopilot devices cannot be deleted directly in the Microsoft Entra ID portal. You’ll need to remove them via PowerShell.
- Run the command:
Get-MsolDevice -ObjectId “DEVICE_OBJECT_ID” - Copy the DeviceID and run:
Remove-MsolDevice -DeviceId “DEVICE_ID”
- Run the command:
Verify the device removal with:
Get-MsolDevice(The device should not be found).Force a delta sync again with:
Start-ADSyncSyncCycle -PolicyType Delta
Conclusion: Sync Success!
After the Autopilot device object was removed from Microsoft Entra ID using PowerShell, the sync conflict was resolved. The user account and device account were successfully merged, and the “AttributeValueMustBeUnique” error no longer appeared.
Key Takeaways:
- Attribute conflicts often occur when user objects and device objects share the same ObjectID.
- Admin role conflicts, soft matching by UPN or email, and hard matching by ImmutableID can help resolve most sync issues.
- Always verify that device objects—especially those from Autopilot or Hybrid Join scenarios—are properly handled to avoid conflicts.
For more troubleshooting tips on Microsoft Entra ID synchronization, Azure AD Connect, and Active Directory integration, don’t hesitate to reach out to our CloudKnowledge team for expert guidance.
If you encounter further issues, feel free to contact CloudKnowledge for assistance!
Recommended Hardware & Reference Architecture Literature
Tested tools and authoritative documentation to implement the architectures covered in this lab:
Thanks for sharing. I read many of your blog posts, cool, your blog is very good.
I don’t think the title of your article matches the content lol. Just kidding, mainly because I had some doubts after reading the article.