azure sync issue in hybrid deployment

Question

azure sync issue in hybrid deployment

Rob Lewis 0

We had an onPrem dynamic distribution group which was deleted, and then a normal onPrem distribution group was created with the same email aliases.

Just one of the aliases wont sync to azure, showing error as below. All the other aliases (and there are a few) all sync fine.
How can i delete the orphaned 'Cloud Only' object from azure to allow me to use this alias on the new distribution group, please?

Thank you

User's image

0 comments

2 answers

Your answer

Answer 1

Dear @Rob Lewis

Thank you for sharing the screenshot and explaining your hybrid Exchange environment.

From the Microsoft Entra Connect Health screenshot, I can see that the synchronization error involves a duplicate proxyAddresses value between an existing Cloud Only object and your newly synchronized on-premises distribution group.

Since the previous dynamic distribution group was deleted and a new distribution group was created using the same aliases, it is possible that an existing cloud object is still retaining the conflicting SMTP address.

Before recommending deletion, I would like to clarify a few details to ensure we identify the correct object and avoid affecting any active mail flow.

Could you please confirm the following?

Original distribution group: Was the previous dynamic distribution group deleted only from on-premises Active Directory/Exchange, or was it also removed from Exchange Online?
Existing cloud object: When you click View current state in Microsoft Entra ID for the Cloud Only object, can you locate it? Does it appear as an active group or a deleted object?
Exchange Online visibility: Can you find the old group in the Exchange Admin Center under Recipients > Groups, or by using Exchange Online PowerShell?
Conflicting alias: Is the affected SMTP address still assigned to another recipient, such as a distribution group, mail contact, shared mailbox, or Microsoft 365 group?
Synchronization: Have you already run a synchronization cycle after deleting the original group? If so, does the same duplicate attribute error persist?

As an initial check, I recommend running the following command in Exchange Online PowerShell, replacing the example address with the conflicting alias:

Get-Recipient -ResultSize Unlimited |
Where-Object {
    $_.EmailAddresses -contains "smtp:******@domain.com"
} |
Format-List Name,RecipientTypeDetails,PrimarySmtpAddress,ExternalDirectoryObjectId

This can help identify an active Exchange Online recipient holding the address.

Please refer to this document: Get-Recipient

If the conflicting object cannot be found among active recipients, we may need to investigate deleted or soft-deleted objects separately.

I would not recommend deleting the Cloud Only object immediately, as we first need to confirm its identity, recipient type, and whether it is still being used.

Once you confirm the results, I can help you determine whether the correct solution is to remove the conflicting alias, recover or clean up an orphaned recipient, or investigate the object’s synchronization state.

BabybooHN 3,465 Reputation points Independent Advisor

2026-10-15T02:16:06.35+00:00

Dear @Rob Lewis

I hope you’re doing well. I just wanted to check in and see how things are going with the steps I shared earlier. If you ran into any difficulties at any point or if something is unclear, please don’t hesitate to let me know. I completely understand that these processes can sometimes be tricky, and I’m here to make it as easy as possible for you.

Feel free to share any details or questions you might have, I’m ready to listen and assist you further.

Answer 2

This is consistent with an orphaned Microsoft Entra group object holding that proxy address.

Use this sequence:

Force a full sync first to confirm the deletion is not just pending:

Start-ADSyncSyncCycle -PolicyType Initial

If the alias still does not sync after the cycle completes, remove the orphaned cloud group object from Microsoft Entra ID.
Connect to Microsoft Graph PowerShell, locate the conflicting group, and delete it.

Example:

Connect-MgGraph

$group = Get-MgGroup -Filter "mail eq '******@contoso.com'"
Remove-MgGroup -GroupId $group.Id

If the conflict is specifically on a proxy address rather than the primary mail value, identify the cloud-only object shown in Connect Health / sync errors, then remove that group by its GroupId.

Run sync again after deletion so the new on-premises distribution group can stamp the alias into Microsoft Entra ID.

Important:

Deleting the wrong cloud object is destructive. Verify the object is the cloud-only orphan before running Remove-MgGroup.
Synced distribution groups must be managed on-premises. Changes made there are synchronized to Microsoft 365 on the next sync cycle.

If the object is not actually cloud-only and is still shown as synchronized from on-premises, delete or correct it in the on-premises Exchange/Active Directory management tools instead of deleting it in Exchange Online or Microsoft Entra ID.