I have migrated Sharepoint 2013 Farm which is joined to Local AD DS to Sharepoint 2016 Farm joined to AzureAD DS.

Client wants to take full use of AzureAD DS and want to migrate sharepoint farm to Azure VMs connected to AzureAD DS.

I created a Sharepoint 2016 farm. created normal webapp/Site collection and is able to access as expected.

When I attach sharepoint 2013 DB after upgrade it gives access denied to those upgrade web app. Do I need to do any changes to existing usernames as they has been now talking to AzureAD DS instead of Local AD.

1 Answer 1


After you attach a database to a SharePoint farm located in an Azure VM, you will likely need to re-assign all permissions from scratch.

This is because logins or login ids in Azure AD DS and AD on-prem might be different for some reason.

Essentially, your situation is very similar to taking an existing SharePoint content database from one domain and attaching it to a new SharePoint farm in another domain. Similar/same users might exist in both domains, but login ids might not match for some reason.

How to check if login/login Ids change

  • Install SP Insider Chrome extension

  • Navigate to an old SP 2013 in your old farm.

  • In SP Insider, note SiteUsers > User A > Note LoginName, NameId (see the screenshot)

  • Navigate to a working site collecting in your new SP 2016 farm. The one that does not give you access denied

  • Grant permissions to a user A.

  • In SP Insider, note SiteUsers > User A > Note LoginName, NameId (see the screenshot)

  • Compare the differences between User A in SP 2013 farm and User A in SP 2016 farm. Do their logins are different? Do their Ids are differ?

enter image description here

Check current user's login name and NameId. Alternative

In both of your farms, open the following URL and not any discrepancies:

https://<Your Site>/_api/web/CurrentUser

enter image description here

Attempt to "migrate" the user

Use the following stsadm command to attempt to migrate a single user. You can keep the -oldlogin and -newlogin the same if they indeed don't change between the farms.

stsadm.exe -o migrateuser -oldlogin Domainname\loginName -newlogin Domainname\loginName -ignoresidhistory
  • 1
    Azure AD is not Azure AD DS. There's no reason that the username format would be different, however there isn't enough information about the configuration between local Active Directory and Azure AD DS to assist.
    – user6024
    Apr 18, 2021 at 16:28
  • Hi Denis, Thanks for the reply. I have made changes as you requested but still having issues accessing the sites. I need to look deeper in this one. Thanks for providing a path on this one. Is there any way the UPS and a Webapp have issues with each other as both have been migrated as we use Audience targeting and UPS need to be migrated. The Full sync is not working in this case. Apr 19, 2021 at 6:52
  • For UPS, see docs.microsoft.com/en-us/azure/active-directory-domain-services/…
    – user6024
    Apr 19, 2021 at 15:13
  • Hi Trevor, Already done that part but with no luck. Apr 21, 2021 at 6:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.