This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 97%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EI%3C/text%3E%3C/svg%3E)
Title
Stale Azure DevOps identity for ******@xxxiq.com causing duplicate identities and login loop after domain federation
Description
We migrated users from Microsoft 365 to Google Workspace and federated the xxxiq.com domain in Microsoft Entra ID.
One user, Taxxx Zuxxx ******@xxxiq.com, is affected in Azure DevOps organization kekik.
The user can sign in to Azure Portal successfully, but Azure DevOps goes into a login loop.
When we try to add the user to the Azure DevOps organization, the user picker shows two identities for the same person:
Taxxx Zuxxx user:PII\\******@xxxiq.com Taxxx Zuxxx ******@xxxiq.comThis appears to be a stale Azure DevOps identity record or duplicate identity mapping.
true MemberRecent Microsoft Entra sign-in logs show Azure DevOps sign-ins reaching Entra successfully for this user, and Conditional Access is not blocking the user.
Examples:
6/26/2026 11:58:23 AM UTC
Azure DevOps Taxxx Zuxxx ******@xxxiq.com
50140 Keep me signed in interrupt cd0337f5-aa94xxx7513871beb5 notApplied6/26/2026 12:00:11 PM UTC
Azure DevOps Taxxx Zuxxx ******@xxxiq.com
notAppliedPlease investigate and remove or merge the stale Azure DevOps identity record for ******@xxxiq.com, so that only the current Entra-backed identity remains:
user:PII\\******@xxxiq.comPlease confirm whether backend identity cleanup is required on the Azure DevOps side.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 23%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVV%3C/text%3E%3C/svg%3E)
Hi ilter,
Welcome to Microsoft Q&A Platform.
As discussed, We removed the affected user from the Azure DevOps organization and added the user back with a valid Object ID (OID). You have confirmed that the issue has been resolved and that you are now able to access the Azure DevOps portal successfully.
Please
and “up-vote” wherever the information provided helps you, **this can be beneficial to other community members.
Successful Entra sign-ins show authentication completes; the loop is likely Azure DevOps identity resolution. In Organization settings > Microsoft Entra ID, run Resolve for disconnected users and match the current Entra object ID.
Before removing anything, list Azure DevOps Graph users and compare descriptor, originId, and principalName. Keep the record whose originId equals the live Entra object ID. Disable only the other descriptor. Do not delete by email because both records share it. Graph delete disables an identity; it does not merge history.
Then clear the user's browser sessions, use a private window, select Work or school account, and sign in again. Re-add the surviving identity if needed and restore its groups and license. If Resolve cannot distinguish the duplicate, open an Azure DevOps support case with both descriptors, the live object ID, organization name, correlation IDs, and timestamps. Microsoft specifically recommends support for unresolved duplicate UPN mappings.