azure sync issue in hybrid deployment

Question

azure sync issue in hybrid deployment

Rob Lewis 0

We had an onPrem dynamic distribution group which was deleted, and then a normal onPrem distribution group was created with the same email aliases.

Just one of the aliases wont sync to azure, showing error as below. All the other aliases (and there are a few) all sync fine.
How can i delete the orphaned 'Cloud Only' object from azure to allow me to use this alias on the new distribution group, please?

Thank you

User's image

0 comments

2 answers

Your answer

Answer 1

Dear @Rob Lewis

Thank you for sharing the screenshot and explaining your hybrid Exchange environment.

From the Microsoft Entra Connect Health screenshot, I can see that the synchronization error involves a duplicate proxyAddresses value between an existing Cloud Only object and your newly synchronized on-premises distribution group.

Since the previous dynamic distribution group was deleted and a new distribution group was created using the same aliases, it is possible that an existing cloud object is still retaining the conflicting SMTP address.

Before recommending deletion, I would like to clarify a few details to ensure we identify the correct object and avoid affecting any active mail flow.

Could you please confirm the following?

Original distribution group: Was the previous dynamic distribution group deleted only from on-premises Active Directory/Exchange, or was it also removed from Exchange Online?
Existing cloud object: When you click View current state in Microsoft Entra ID for the Cloud Only object, can you locate it? Does it appear as an active group or a deleted object?
Exchange Online visibility: Can you find the old group in the Exchange Admin Center under Recipients > Groups, or by using Exchange Online PowerShell?
Conflicting alias: Is the affected SMTP address still assigned to another recipient, such as a distribution group, mail contact, shared mailbox, or Microsoft 365 group?
Synchronization: Have you already run a synchronization cycle after deleting the original group? If so, does the same duplicate attribute error persist?

As an initial check, I recommend running the following command in Exchange Online PowerShell, replacing the example address with the conflicting alias:

Get-Recipient -ResultSize Unlimited |
Where-Object {
    $_.EmailAddresses -contains "smtp:******@domain.com"
} |
Format-List Name,RecipientTypeDetails,PrimarySmtpAddress,ExternalDirectoryObjectId

This can help identify an active Exchange Online recipient holding the address.

Please refer to this document: Get-Recipient

If the conflicting object cannot be found among active recipients, we may need to investigate deleted or soft-deleted objects separately.

I would not recommend deleting the Cloud Only object immediately, as we first need to confirm its identity, recipient type, and whether it is still being used.

Once you confirm the results, I can help you determine whether the correct solution is to remove the conflicting alias, recover or clean up an orphaned recipient, or investigate the object’s synchronization state.

BabybooHN 3,465 Reputation points Independent Advisor

2026-10-15T02:16:06.35+00:00

Dear @Rob Lewis

I hope you’re doing well. I just wanted to check in and see how things are going with the steps I shared earlier. If you ran into any difficulties at any point or if something is unclear, please don’t hesitate to let me know. I completely understand that these processes can sometimes be tricky, and I’m here to make it as easy as possible for you.

Feel free to share any details or questions you might have, I’m ready to listen and assist you further.
Rob Lewis 0 Reputation points

2026-10-15T08:21:21.2+00:00

thank you! Here are the answers to the questions posed:

the dynamic group was deleted from onPrem. There was a 'contact' in exOL with the exact same alias, which I deleted from exOL using the gui

when i click 'view current state in entraID' I see Resource 'a8e8****-----------------d1' does not exist or one of its queried reference-property objects are not present.

I cannot see the original group in exOL either in the gui or with powershell

no, the alias does not intentionally exist anywhere else.

yes - after deleting the original group i performed a sync cycle and waited an hour before attempting to re-use the alias

I have run your script. If I run it while connected to exOL there are no results at all. If I run is while connected to onPrem I see my new distribution group.
Thank you
Rob Lewis 0 Reputation points

2026-10-15T10:20:00.5433333+00:00

Thank you - I ran this little lot and the issue is now resolved:

Install-Module -Name Microsoft.Entra -Scope AllUsers -Force -AllowClobber

connect-mggraph

Connect-Entra -Scopes 'OrgContact.Read.All'

$contact = Get-EntraContact -Filter "displayName eq '******@etc.etc'"

Remove-EntraContact -OrgContactId $contact.Id

ran it and it reported success

ran it a second time and it failed, so suggests the first run did something

since the last sync the issue has now gone away and the alias has now populated correctly with the new group

thank you for your help, which definately pointed me in the right direction

Answer 2

This is consistent with an orphaned Microsoft Entra group object holding that proxy address.

Use this sequence:

Force a full sync first to confirm the deletion is not just pending:

Start-ADSyncSyncCycle -PolicyType Initial

If the alias still does not sync after the cycle completes, remove the orphaned cloud group object from Microsoft Entra ID.
Connect to Microsoft Graph PowerShell, locate the conflicting group, and delete it.

Example:

Connect-MgGraph

$group = Get-MgGroup -Filter "mail eq '******@contoso.com'"
Remove-MgGroup -GroupId $group.Id

If the conflict is specifically on a proxy address rather than the primary mail value, identify the cloud-only object shown in Connect Health / sync errors, then remove that group by its GroupId.

Run sync again after deletion so the new on-premises distribution group can stamp the alias into Microsoft Entra ID.

Important:

Deleting the wrong cloud object is destructive. Verify the object is the cloud-only orphan before running Remove-MgGroup.
Synced distribution groups must be managed on-premises. Changes made there are synchronized to Microsoft 365 on the next sync cycle.

If the object is not actually cloud-only and is still shown as synchronized from on-premises, delete or correct it in the on-premises Exchange/Active Directory management tools instead of deleting it in Exchange Online or Microsoft Entra ID.