I have a quick question to understand how the whole AD on premises sync works with Azure AD. While troubleshooting an issue for a user we found that the user was added with useraccount@tenant.onmicrosoft.com . When the user would try to sign in it would say the "username or password is incorrect". After repeated attempts to change the username and password nothing worked.

A colleague of mine then looked at AD and found an account DOMAIN\user which did not replicate to the cloud. He fixed something and the account got replicated.

Now, what happened was that somehow the onmicrosoft.com cloud account got automatically "fixed" and the AD identity got "merged" with it. Which is good because the accounts are for the same user and the issue got fixed.

However, what I am struggling to understand is that what was the link between the 2 accounts? How did the tool know that this account is for the same person and changed the onmicrosoft.com to the AD account (and the onmicrosoft.com account no longer exists in Azure AD).

Not sure if it matters but the onmicrosoft cloud account was created by a ShareGate migration.

Can some one please help me understand this?



Azure AD Connect will perform name mapping. See Azure AD Connect: When you have an existent tenant.

  • Thank you Trevor. – Rafay Ali Aug 21 '20 at 8:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.