Entra Connect Sync Errors Detected: A Read-First Duplicate Attribute, Soft Match, and 8344 Permission Triage

The daily email says Microsoft Entra Connect sync errors detected. Connect Health lists an AttributeValueMustBeUnique on a new hire's proxyAddresses. Synchronization Service Manager shows an Export run that ended in completed-export-errors, and one row says permission-issue, error 8344. Someone in the ticket is already suggesting you delete the cloud user and "let sync recreate it."

Don't delete anything yet. An on-premises object only lands correctly in Microsoft Entra ID when the whole chain holds: the object is in sync scope → the sync engine is actually running and exporting (not in staging mode) → its UPN and primary SMTP address are unique across every user, group, and contact in the tenant → if a cloud object already exists, the hard match or soft match is allowed → the attribute values pass Entra's validation and size limits → for writeback features, the AD DS connector account can write back to AD. The error type tells you which link failed. The two objects involved (and which one should keep the value) tell you the fix.

If the problem is computers stuck as Pending rather than users with sync errors, start with the Hybrid Azure AD Join Pending triage. If Connect-MgGraph refuses the read-only queries below, the Connect-MgGraph "Insufficient privileges" walkthrough covers scopes and roles. This post covers Microsoft Entra Connect Sync (the on-premises sync engine) and the export errors it reports.

TL;DR

• Find out which connector failed. Errors on export to the Entra connector (contoso.onmicrosoft.com - AAD) are cloud-side data conflicts. permission-issue 8344 on export to the Active Directory connector means the connector account can't write back to AD.
• AttributeValueMustBeUnique = two objects want the same userPrincipalName, proxyAddresses, mail, or signInName. Fix the data in the source directory (usually on-premises AD), then let sync run.
• InvalidSoftMatch = the cloud object that matches on UPN or primary SMTP already has a different immutableId. It belongs to another on-premises object. Common after someone deletes and recreates an AD user, or after a forest move or reinstall that changed the sourceAnchor.
• Soft match only uses UPN and the primary SMTP address, and only for new incoming objects. Changing an existing object so it matches gives you an error, not a merge.
• Duplicate attribute resiliency quarantines a duplicate UPN or SMTP address instead of failing the export. The user can end up with a placeholder onmicrosoft.com UPN, and the conflict is shown in the email only once.
• 8344 = the MSOL_ connector account lacks write permission on that object. The usual causes are disabled inheritance or a protected (AdminSDHolder) account.
• Hard match hardening (enforced since July 1, 2026) blocks takeover of cloud users that hold or are eligible for privileged roles, or that already have onPremisesObjectIdentifier set (InvalidHardMatch).

---

Where in the chain did it break?

Step	What should be true	Typical symptom when it breaks
1. Error read	You know the error type, the connector, and both objects involved	"Sync errors detected" email with no object you recognize
2. Engine health	Scheduler enabled, not in staging mode, recent successful export	No errors at all, but nothing new arrives in Entra
3. Error type	The error is decoded to one family (duplicate, mismatch, validation, size, permission)	Every error treated as "re-run a full sync"
4. Uniqueness	UPN / primary SMTP / proxyAddresses are unique across users, groups, and contacts	AttributeValueMustBeUnique, ObjectTypeMismatch, quarantined placeholder UPN
5. Matching	The existing cloud object can legally be matched (no foreign immutableId, no blocked privileged takeover)	InvalidSoftMatch, InvalidHardMatch, Existing Admin Role Conflict
6. Writeback permission	The AD DS connector account can write the attributes it exports back to AD	permission-issue / 8344 on the AD connector Export run
7. Scope and data	Object is in a synced domain/OU, UPN suffix is verified, values pass validation and size limits	User never appears; UPN lands as onmicrosoft.com; DataValidationFailed; LargeObject

Pick one object in error and read it at each step. Most export errors involve two objects, so write both down before you change anything.

Step 1: Read the error, the connector, and both objects

There are three places to read the same errors, and they don't show the same things:

Where	What it shows	Notes from Microsoft
Microsoft Entra Connect Health > Sync errors (Entra admin center)	Errors grouped into categories, with a side-by-side view of the conflicting objects and a CSV export	Needs Microsoft Entra ID P1. Updated every 30 minutes from the Health agent. Covers the latest Export to the Entra connector
Microsoft 365 admin center > Home > User management card > Sync errors	Directory sync errors with fix tips	Shows User objects only (no groups or contacts)
Synchronization Service Manager > Operations (on the Entra Connect server)	Every run per connector, with status, the object in error, and the error detail	Run history is kept 7 days by default

Connect Health's categories map almost one-to-one to the error families in Step 3: Duplicate Attribute, Data Mismatch (soft match failures), Data Validation Failure, Federated Domain Change, Large Attribute, and Other.

In Synchronization Service Manager, read the Status column in Microsoft's priority order:

Status	Meaning
stopped-*	The run couldn't finish, for example because the remote system couldn't be contacted
stopped-error-limit	More than 5,000 errors. The run stopped itself
completed-*-errors	The run finished with errors (fewer than 5,000). This is where completed-export-errors lives
completed-*-warnings	Finished, but data isn't in the expected state. Fix errors first
success	No issues

Then note which connector the failing run belongs to. The Entra connector is named like contoso.onmicrosoft.com - AAD. An Export error there is a cloud-side conflict (Steps 4 and 5). An Export error on the Active Directory connector is the sync engine writing back to AD (Step 6).

About the email. Connect Health's notification settings (Sync errors > Notification Settings) control who gets alerts. Microsoft also says its backend sends sync-error email as a daily digest of the previous day's unresolved errors, so an error you fixed within the day may never show up in an email. The digest is a pointer, not the full list. Read the report.

Step 2: Confirm the engine is actually exporting

Before you decode anything, rule out the boring causes: the scheduler is off, the server is in staging mode, or a cycle is still running. Read-only, on the Entra Connect server (elevated PowerShell):

Import-Module ADSync

# Scheduler state: is it cycling, and is this server allowed to export?
Get-ADSyncScheduler |
  Select-Object SyncCycleEnabled, StagingModeEnabled, SchedulerSuspended,
                CurrentlyEffectiveSyncCycleInterval, NextSyncCyclePolicyType, NextSyncCycleStartTimeInUTC

# Empty output = engine idle; otherwise the name of the connector currently running
Get-ADSyncConnectorRunStatus

# Last few run results (read the result string for each connector/run profile)
Get-ADSyncRunProfileResult -NumberRequested 10 | Format-List

How to read it:

Field	Healthy	If not
SyncCycleEnabled	True	Someone disabled the scheduler (often during a filtering change) and didn't turn it back on
StagingModeEnabled	False on the active server	Staging mode suppresses exports but still runs import and sync. Errors and changes never reach Entra from this server
SchedulerSuspended	False	Set by Connect during an upgrade. Microsoft says not to change it yourself
CurrentlyEffectiveSyncCycleInterval	00:30:00 by default	A custom interval can make "it didn't sync" just "it hasn't run yet"

Cloud side, read the tenant's last sync time with Microsoft Graph PowerShell (read-only):

Connect-MgGraph -Scopes 'Organization.Read.All'
Get-MgOrganization | Select-Object DisplayName, OnPremisesSyncEnabled, OnPremisesLastSyncDateTime   # UTC

If OnPremisesLastSyncDateTime is hours old while the server says it's cycling every 30 minutes, check whether you're looking at the staging server.

Step 3: Decode the error type

From Microsoft's Troubleshoot errors during synchronization article and the 8344 troubleshooting article:

Error	Connector	What Microsoft says it means	Go to
AttributeValueMustBeUnique	Entra	A new or updated object carries a mail, proxyAddresses, signInName, or userPrincipalName value another Entra object already has	Step 4
ObjectTypeMismatch	Entra	Soft match found an object of a different type (user vs group vs contact) with the same value, typically proxyAddresses	Step 4
InvalidSoftMatch	Entra	No hard match, soft match found an object, but that object has a different immutableId (it was synced from another AD object)	Step 5
InvalidHardMatch (103) / AttributeUpdateNotAllowed (96)	Entra	Hard match blocked: target is privileged (assigned or eligible), already has onPremisesObjectIdentifier, or takeover is blocked tenant-wide	Step 5
Existing Admin Role Conflict	Entra	Soft match on UPN with a cloud user that holds an admin role isn't allowed	Step 5
DataValidationFailed / IdentityDataValidationFailed	Entra	UPN has invalid or unsupported characters or format, or onPremisesObjectIdentifier changed during a hard match	Step 7
LargeObject / ExceededAllowedLength	Entra	The object exceeds a size, length, or count limit (often userCertificate, userSMIMECertificate, thumbnailPhoto, proxyAddresses)	Step 7
DeletingCloudOnlyObjectNotAllowed (Error Type 114)	Entra	Sync tried to delete an object Entra treats as cloud-only. Common while moving from hybrid to cloud-only	Microsoft's article has a specific recovery
permission-issue / 8344 "Insufficient access rights to perform the operation."	Active Directory	The AD DS connector account (MSOL_…) can't write the attribute it's exporting back to AD	Step 6

Microsoft notes its article covers the common errors, not every possible one. If your error string isn't here, copy the full detail from the object's Export Error tab (or the Stack Trace for sync-rule errors) before you search.

Step 4: Find both objects in a uniqueness conflict

The Entra schema requires these values to be unique across all users, groups, and contacts. That's why a new user can collide with a mail-enabled group someone created in Microsoft 365 last week (ObjectTypeMismatch).

Microsoft's fix is the same for AttributeValueMustBeUnique, ObjectTypeMismatch, and the data side of InvalidSoftMatch: identify the duplicated value and every object involved → decide which object should keep it → remove it from the other object in the directory that object is sourced from → let sync run. Connect Health's side-by-side view usually names both objects. If it doesn't, read both directories yourself.

On-premises (RSAT ActiveDirectory module, read-only). This searches users, groups, and contacts at once:

$value = '[e-mail]'   # the conflicting address/UPN from the error

Get-ADObject -LDAPFilter "(|(userPrincipalName=$value)(mail=$value)(proxyAddresses=smtp:$value))" `
  -Properties objectClass, userPrincipalName, mail, proxyAddresses, 'mS-DS-ConsistencyGuid', whenCreated |
  Select-Object Name, ObjectClass, DistinguishedName, UserPrincipalName, Mail, whenCreated,
    @{n='ProxyMatch'; e={ $_.proxyAddresses | Where-Object { $_ -like "*:$value" } }}

In Entra (Microsoft Graph PowerShell, read-only):

Connect-MgGraph -Scopes 'User.Read.All','Group.Read.All','OrgContact.Read.All'
$value = '[e-mail]'
$sel   = 'id,displayName,userPrincipalName,mail,onPremisesSyncEnabled,onPremisesImmutableId'

$hits = @()
$hits += Get-MgUser -Filter "userPrincipalName eq '$value'" -Property $sel -ErrorAction SilentlyContinue
foreach ($p in "SMTP:$value", "smtp:$value") {
  $hits += Get-MgUser    -All -Filter "proxyAddresses/any(x:x eq '$p')" -Property $sel -ConsistencyLevel eventual -CountVariable c1
  $hits += Get-MgGroup   -All -Filter "proxyAddresses/any(x:x eq '$p')" -ConsistencyLevel eventual -CountVariable c2
  $hits += Get-MgContact -All -Filter "proxyAddresses/any(x:x eq '$p')" -ConsistencyLevel eventual -CountVariable c3
}
$hits | Where-Object { $_ } | Sort-Object Id -Unique |
  Select-Object Id, DisplayName, UserPrincipalName, Mail, OnPremisesSyncEnabled, OnPremisesImmutableId,
    @{n='Type'; e={ $_.GetType().Name }}

The script tries both prefix casings (SMTP: primary, smtp: secondary) and de-duplicates the results. You get one row per object that holds the value.

Quarantined duplicates (duplicate attribute resiliency). Microsoft has turned this on for all tenants, and it can't be turned off. When an incoming UPN or SMTP proxy address would break uniqueness, Entra quarantines that value instead of failing the export. If the attribute is required (UPN), Entra assigns a placeholder UPN in the tenant's onmicrosoft.com domain with a 4-digit number added (Microsoft's example: [e-mail]). Because the export technically succeeded, the sync client logs no error and doesn't retry. The conflict appears in the error email once. A background task runs every hour and releases the quarantined value automatically after you fix the conflict.

Those quarantined values are stored on the object. List them (read-only):

Connect-MgGraph -Scopes 'User.Read.All'
Get-MgUser -All -Filter "onPremisesProvisioningErrors/any(o:o/category eq 'PropertyConflict')" `
  -ConsistencyLevel eventual -CountVariable n `
  -Property id, displayName, userPrincipalName, onPremisesProvisioningErrors |
  ForEach-Object {
    foreach ($e in $_.OnPremisesProvisioningErrors) {
      [pscustomobject]@{
        User     = $_.DisplayName
        UPN      = $_.UserPrincipalName
        Property = $e.PropertyCausingError   # UserPrincipalName or ProxyAddresses
        Value    = $e.Value
        Occurred = $e.OccurredDateTime        # UTC
      }
    }
  }

Groups and contacts carry the same property. Run the same filter with Get-MgGroup / Get-MgContact if the conflict could involve them. Microsoft also lists a known issue: some user-vs-group proxy address combinations still throw a normal export error instead of being quarantined.

Step 5: Read the match (soft vs hard) before you "merge" anything

Microsoft's matching rules for a new incoming object:

1. Hard match: Entra looks for an object whose immutableId equals the incoming sourceAnchor. By default that's the Base64 of mS-DS-ConsistencyGuid (or objectGUID, depending on configuration).
2. Soft match: if there's no hard match, Entra tries the incoming userPrincipalName or primary SMTP address. Only the SMTP: value counts, not secondary smtp: addresses.
3. Neither matches: Entra creates a new object.

Matching is only evaluated for new objects. If you edit an existing synced object so it suddenly matches another one, you get an error, not a merge. Read the cloud object you found in Step 4 and compare:

Cloud object you found	Read it as
OnPremisesImmutableId empty, OnPremisesSyncEnabled empty/false, no admin role	A legal soft-match target. If the match is intended, it takes over the cloud object (see the warning below)
OnPremisesImmutableId set to a different value than the incoming object's sourceAnchor	InvalidSoftMatch (or AttributeValueMustBeUnique). It already belongs to another AD object. Find out which AD object is the real one before you touch either
Cloud user holds an admin role	Soft match isn't allowed (Existing Admin Role Conflict). Since July 1, 2026, hard match is also blocked for users with assigned or eligible privileged roles (InvalidHardMatch)
onPremisesObjectIdentifier already set	Hard match blocked by the security hardening. Microsoft's recovery article explains how to clear it deliberately

Read the role side (read-only). This lists active role assignments. Check PIM for eligible ones too:

Connect-MgGraph -Scopes 'User.Read.All','RoleManagement.Read.Directory'
$u = Get-MgUser -UserId '[e-mail]' -Property id,userPrincipalName,onPremisesImmutableId,onPremisesSyncEnabled
$u | Select-Object UserPrincipalName, OnPremisesImmutableId, OnPremisesSyncEnabled
Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '$($u.Id)'" -ExpandProperty RoleDefinition |
  Select-Object @{n='Role'; e={ $_.RoleDefinition.DisplayName }}, DirectoryScopeId

Tenant-wide switches can also block matching. Microsoft Graph exposes them on onPremisesDirectorySynchronization (requires OnPremDirectorySynchronization.Read.All, and Microsoft documents Global Administrator as the only supported role for this read):

Connect-MgGraph -Scopes 'OnPremDirectorySynchronization.Read.All'
$r = Invoke-MgGraphRequest -Method GET -Uri 'https://graph.microsoft.com/v1.0/directory/onPremisesSynchronization'
$o = if ($r.value) { $r.value[0] } else { $r }
$o.features | Select-Object blockSoftMatchEnabled, blockCloudObjectTakeoverThroughHardMatchEnabled, synchronizeUpnForManagedUsersEnabled

Feature	If true
blockSoftMatchEnabled	Soft match is blocked for all objects. Microsoft encourages keeping it on except while you deliberately soft-match
blockCloudObjectTakeoverThroughHardMatchEnabled	Hard match can't take over an existing cloud object (a documented cause of InvalidHardMatch after re-adding a user to scope)
synchronizeUpnForManagedUsersEnabled	UPN changes sync for licensed, managed-authentication users. If false, UPN updates for those users don't sync (Step 7)

Before any intended soft match: Microsoft warns that the on-premises values overwrite every matching attribute in Entra, and with password hash sync the cloud password hash is replaced by the AD one. Microsoft also strongly recommends against syncing on-premises accounts onto pre-existing cloud admin accounts.

Step 6: permission-issue 8344 on the AD connector

From Microsoft's 8344 article: on Operations, the Active Directory connector's Export run shows completed-export-errors. The object's Export Error tab reads permission-issue, connected data source error code 8344, "Insufficient access rights to perform the operation." The cause: the AD DS connector account (MSOL_… by default) can't write back the attribute the sync engine is exporting to AD.

Read before you grant anything:

1. Which account? In the Entra Connect wizard: Configure > View or export current configuration (the ACCOUNT under Synchronized Directories). Or run Get-ADSyncToolsADconnectorAccount from the ADSyncTools module.
2. Which attribute? Open the failing object, then Pending Export tab > Attribute information, sorted by Changes. Typical writebacks: mS-DS-ConsistencyGuid when it's the source anchor, Exchange hybrid writeback attributes such as msDS-ExternalDirectoryObjectID, and password or group writeback.
3. Why this object and not its neighbors? Usually inheritance is disabled on the object or a parent OU, or the object is a protected account.

Read the inheritance and adminCount state (read-only, RSAT):

$u = Get-ADUser -Identity 'bob' -Properties adminCount, nTSecurityDescriptor, DistinguishedName
[pscustomobject]@{
  User               = $u.SamAccountName
  DN                 = $u.DistinguishedName
  adminCount         = $u.adminCount                                   # >0 = governed by AdminSDHolder (or was)
  InheritanceBlocked = $u.nTSecurityDescriptor.AreAccessRulesProtected # True = doesn't inherit OU/domain ACEs
}

Finding	Read it as
InheritanceBlocked = True, adminCount empty	Inheritance turned off on the object (or check each parent OU up to the domain root). Permissions granted at the domain root never reach it
adminCount = 1 and the user is in a protected group	AdminSDHolder. SDProp resets protected accounts' permissions to the AdminSDHolder template every 60 minutes by default, so ACEs you add to the user disappear
adminCount = 1 but the user is no longer in any protected group	Microsoft lists this as a known issue its standard fixes don't solve: new permissions aren't applied

The Entra Connect Troubleshoot task (wizard > Additional tasks > Troubleshoot > Launch) has a Configure AD DS Connector Account Permissions menu. Its read options include Get AD Connector account, Get objects with inheritance disabled, and Show AD object permissions. Microsoft's preferred fix is the matching Set … permissions option in that menu (or the ADSyncConfig module) for the feature you actually use. When it prompts Update AdminSDHolder, Microsoft says to answer Yes only if you deliberately sync protected accounts, and its guidance is not to sync on-premises admin accounts at all.

Step 7: No error, but the object (or its UPN) still isn't right

Symptom	Microsoft's documented cause	Read
User never appears in Entra, no error anywhere	Domain or OU filtering puts it out of scope, or the domain is missing run profiles/steps	Wizard Troubleshoot > Troubleshoot Object Synchronization (object DN + AD connector name). It checks domain/OU filtering, UPN mismatch, linked mailbox, and dynamic distribution groups, and writes an HTML report
User synced, but UPN is …@contoso.onmicrosoft.com	The UPN suffix isn't a verified domain in the tenant, so Entra substitutes onmicrosoft.com. (A quarantined duplicate UPN also does this; see Step 4)	Entra admin center Custom domain names; Step 4 provisioning errors
UPN changed on-premises but not in Entra	SynchronizeUpnForManagedUsers disabled blocks UPN updates for licensed managed users	Step 5 feature read
DataValidationFailed	Unsupported characters or format in userPrincipalName	The UPN string in AD
LargeObject	Object size limit. userCertificate has a hard limit of 15 certificates. Microsoft's rule of thumb is about 300 proxy addresses	Expired certificates and outdated addresses on the AD object

In Synchronization Service Manager, Connectors > [AD connector] > Search Connector Space shows whether the engine imported the object at all. Searching the Entra connector's Pending Import with Add checked shows cloud objects the engine can't associate with any on-premises object (orphans from another sync engine or an old filtering setup). The same object read in PowerShell, read-only:

Get-ADSyncCSObject -ConnectorName 'contoso.com' -DistinguishedName 'CN=Bob Taylor,OU=Staff,DC=contoso,DC=com'

On a connector space object, Preview > Generate Preview keeps the result in memory only. Commit Preview updates the metaverse and stages changes to the target connectors, so it isn't a read.

---

Timing: when "still broken" is just waiting

Event	Microsoft's timing
Built-in sync scheduler	Every 30 minutes by default (delta: import → sync → export on all connectors)
Connect Health sync error report	Refreshed every 30 minutes from the Health agent's data
Quarantined duplicate released after you fix the conflict	Background task runs every hour
Sync error email	Daily digest of the previous day's unresolved errors
SDProp re-applies AdminSDHolder ACLs	Every 60 minutes by default (PDC emulator)
Run history in Synchronization Service Manager	Kept 7 days by default
Hard match security hardening	Enforced automatically since July 1, 2026

After a fix in AD, a delta cycle (Start-ADSyncSyncCycle -PolicyType Delta) is enough. Microsoft notes a full cycle (-PolicyType Initial) can be very time-consuming. Save it for configuration changes that need it.

---

When a change is justified

Finding	Prefer	Avoid
Two AD objects share a UPN or proxy address	Decide the rightful owner, remove the value from the other object in AD, let delta sync run. Connect Health's Fix this error guides supported duplicate-attribute cases	Editing the synced object in Entra or Exchange Online (the source of authority is AD)
New AD user collides with a mail-enabled cloud group (ObjectTypeMismatch)	Change the address on whichever object shouldn't have it, at its source	Deleting the group to "make room" without checking who mails it
InvalidSoftMatch after an AD user was deleted and recreated	Confirm which AD object is the real person and which cloud object holds the mailbox/OneDrive, then fix the data at the source	Hard-deleting the cloud user to clear the error before you know what data it owns
Intended soft match onto a cloud-only user	Clean the on-prem data first (it overwrites cloud values and the password hash). Remove admin roles first if Microsoft's path requires it, then restore	Matching on-prem admin accounts onto existing cloud admins
InvalidHardMatch on a privileged user	Follow Microsoft's recovery table (temporarily remove the role or eligibility, then restore). Re-enable any bypass you turned on	Leaving blockCloudObjectTakeoverThroughHardMatchEnabled off, or a bypass flag on, after the fix
8344 on ordinary users	Grant the specific feature's permissions with the Troubleshoot console or ADSyncConfig, scoped to the right OU. Re-enable inheritance where it was turned off by mistake	Adding MSOL_ to Domain Admins, or a blanket read/write-all ACE at the domain root
8344 on protected accounts	Ask whether they should sync at all. Exclude them, or update AdminSDHolder only by deliberate decision	Adding ACEs to the user object (SDProp removes them within the hour)
adminCount = 1 on a user no longer in any protected group	Treat it as Microsoft's documented known issue and fix it with the AD team, after confirming nested membership	Clearing adminCount across a whole OU in one go
LargeObject	Remove expired certificates and addresses that are truly unused	Bulk-deleting X.500 addresses without checking whether they keep replies to old mail working
Exports never arrive	Confirm the active server isn't in staging mode and the scheduler is enabled	Running Start-ADSyncSyncCycle -PolicyType Initial on repeat

---

FAQ

What does the "Microsoft Entra Connect sync errors detected" email mean?
Entra's sync backend rejected (or quarantined) at least one change from your sync server on the previous day, and it was still unresolved. Microsoft sends it as a daily digest. Open Connect Health > Sync errors (or the Microsoft 365 admin center Sync errors page for users) for the full list, the error category, and both objects in each conflict.

How do I fix AttributeValueMustBeUnique in Entra Connect?
Find every object that holds the duplicated value (UPN, mail, proxyAddresses, or signInName) across users, groups, and contacts. Decide which one should keep it, and remove it from the other in the directory that object comes from (usually on-premises AD). Then let the next sync cycle export the change. Don't edit the synced object in the cloud.

What's the difference between a soft match and a hard match?
A hard match pairs an incoming object with a cloud object whose immutableId equals its sourceAnchor (mS-DS-ConsistencyGuid or objectGUID). A soft match pairs it on UPN or primary SMTP address when no hard match exists, and only if the cloud object has no immutableId yet. A cloud object that already has a different immutableId produces InvalidSoftMatch.

How do I fix Entra Connect permission-issue error 8344?
Find the AD DS connector account and the attribute it was trying to write (Pending Export tab). Then check the object for disabled inheritance or adminCount. Microsoft's preferred fix is the Entra Connect Troubleshoot console's Configure AD DS Connector Account Permissions option for that feature, or the ADSyncConfig module. Update AdminSDHolder only if you intentionally sync protected accounts.

Why is one user not syncing to Entra ID when there's no error?
Usually it's out of scope (domain or OU filtering), the server you're looking at is in staging mode, or the user did sync but with a placeholder or onmicrosoft.com UPN (an unverified UPN suffix, or a quarantined duplicate). Run the wizard's Troubleshoot Object Synchronization task with the object's DN, and check the user's onPremisesProvisioningErrors.

---

Related posts

• Hybrid Azure AD Join Pending: A Read-First Triage Order for Entra Connect Admins
• Entra ID Break-Glass Accounts: Best Practices After Mandatory MFA (why emergency admin accounts stay cloud-only and out of sync scope)
• Connect-MgGraph "Insufficient privileges to complete the operation": scopes, roles, consent, and app-only
• An offboarding checklist for M365 + Intune admins: disable vs delete, license reclaim, and the device decision (deleting and recreating accounts is a classic InvalidSoftMatch source)

Free checklist

Two of the errors above, InvalidHardMatch and Existing Admin Role Conflict, exist because synced identities and privileged cloud accounts can collide. Keeping emergency-access accounts cloud-only, excluded, and tested is part of the groundwork before you enforce Conditional Access. The free Conditional Access pre-enforcement checklist keeps break-glass, pilot groups, and report-only review on one page:

👉 https://cashflow4375.gumroad.com/l/ujkqxb?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=entra-connect-sync-errors-detected

If you want the rest of the identity and Intune runway written down for the team (enrollment hygiene, compliance phasing, break/fix cards and read-only PowerShell snapshots), the Intune & M365 Admin Starter Pack pairs with this triage: https://cashflow4375.gumroad.com/l/joonf?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=entra-connect-sync-errors-detected

---

Admin Pack Studio; not affiliated with Microsoft. Steps 1–7 only read (the Graph calls are GET-only; the ADSync and AD cmdlets shown are Get- reads; Generate Preview stays in memory) until you deliberately change AD data, connector permissions, roles, or tenant sync features. Fix one conflicting object first and confirm it exports cleanly before you bulk-edit, and check current Microsoft docs for matching rules, hard match hardening, and sync feature defaults.