azure sync issue in hybrid deployment

Rob Lewis 0 Reputation points
2026-10-14T14:41:44.68+00:00

We had an onPrem dynamic distribution group which was deleted, and then a normal onPrem distribution group was created with the same email aliases.

Just one of the aliases wont sync to azure, showing error as below. All the other aliases (and there are a few) all sync fine.
How can i delete the orphaned 'Cloud Only' object from azure to allow me to use this alias on the new distribution group, please?

Thank you

User's image

Exchange | Hybrid management
Exchange | Hybrid management

The administration of a hybrid deployment that connects on-premises Exchange Server with Exchange Online, enabling seamless integration and centralized control.

0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-10-14T14:42:02.84+00:00

    This is consistent with an orphaned Microsoft Entra group object holding that proxy address.

    Use this sequence:

    1. Force a full sync first to confirm the deletion is not just pending:
    Start-ADSyncSyncCycle -PolicyType Initial
    1. If the alias still does not sync after the cycle completes, remove the orphaned cloud group object from Microsoft Entra ID.
    2. Connect to Microsoft Graph PowerShell, locate the conflicting group, and delete it.

    Example:

    Connect-MgGraph

$group = Get-MgGroup -Filter "mail eq '******@contoso.com'"
Remove-MgGroup -GroupId $group.Id

    If the conflict is specifically on a proxy address rather than the primary mail value, identify the cloud-only object shown in Connect Health / sync errors, then remove that group by its GroupId.

    1. Run sync again after deletion so the new on-premises distribution group can stamp the alias into Microsoft Entra ID.

    Important:

    • Deleting the wrong cloud object is destructive. Verify the object is the cloud-only orphan before running Remove-MgGroup.
    • Synced distribution groups must be managed on-premises. Changes made there are synchronized to Microsoft 365 on the next sync cycle.

    If the object is not actually cloud-only and is still shown as synchronized from on-premises, delete or correct it in the on-premises Exchange/Active Directory management tools instead of deleting it in Exchange Online or Microsoft Entra ID.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. BabybooHN 3,465 Reputation points Independent Advisor
    2026-10-14T15:05:29.92+00:00

    Dear @Rob Lewis

    Thank you for sharing the screenshot and explaining your hybrid Exchange environment.

    From the Microsoft Entra Connect Health screenshot, I can see that the synchronization error involves a duplicate proxyAddresses value between an existing Cloud Only object and your newly synchronized on-premises distribution group.

    Since the previous dynamic distribution group was deleted and a new distribution group was created using the same aliases, it is possible that an existing cloud object is still retaining the conflicting SMTP address.

    Before recommending deletion, I would like to clarify a few details to ensure we identify the correct object and avoid affecting any active mail flow.

    Could you please confirm the following?

    1. Original distribution group: Was the previous dynamic distribution group deleted only from on-premises Active Directory/Exchange, or was it also removed from Exchange Online?
    2. Existing cloud object: When you click View current state in Microsoft Entra ID for the Cloud Only object, can you locate it? Does it appear as an active group or a deleted object?
    3. Exchange Online visibility: Can you find the old group in the Exchange Admin Center under Recipients > Groups, or by using Exchange Online PowerShell?
    4. Conflicting alias: Is the affected SMTP address still assigned to another recipient, such as a distribution group, mail contact, shared mailbox, or Microsoft 365 group?
    5. Synchronization: Have you already run a synchronization cycle after deleting the original group? If so, does the same duplicate attribute error persist?

    As an initial check, I recommend running the following command in Exchange Online PowerShell, replacing the example address with the conflicting alias:

    Get-Recipient -ResultSize Unlimited |
Where-Object {
    $_.EmailAddresses -contains "smtp:******@domain.com"
} |
Format-List Name,RecipientTypeDetails,PrimarySmtpAddress,ExternalDirectoryObjectId

    This can help identify an active Exchange Online recipient holding the address.

    Please refer to this document: Get-Recipient

    If the conflicting object cannot be found among active recipients, we may need to investigate deleted or soft-deleted objects separately.

    I would not recommend deleting the Cloud Only object immediately, as we first need to confirm its identity, recipient type, and whether it is still being used.

    Once you confirm the results, I can help you determine whether the correct solution is to remove the conflicting alias, recover or clean up an orphaned recipient, or investigate the object’s synchronization state.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.