Azure DevOps: stale guest identity still linked to active member's record, @mentions fail with "The identity does not have sufficient permissions"

Summary

In our Azure DevOps Services organization (backed by Microsoft Entra ID), three user records each have a stale identity linked alongside the user's current identity. The stale identities still show up in people search and @mention lookups. Mentions that resolve to them fail with:

<user> cannot be mentioned in <work item>. The identity does not have sufficient permissions.

We need Microsoft to remove the stale identities while keeping the active identities and their history. All identifiers (organization, tenant, record IDs, identity IDs, Entra object IDs) are in support case 2610280050002044. We're posting here because the support portal sent us to Q&A.

Environment

• Azure DevOps Services, organization connected to Microsoft Entra ID
• 3 affected users, all with the same pattern:
  • 2 users: an old B2B guest account on a former company domain, linked to the user's current member account. One guest has been permanently deleted from Entra; the other still exists as an unredeemed invite.
  • 1 user: a pending invite to a personal email address (bnd. placeholder identity, no Entra object), linked to the user's current member account.

What we've found

• Looking up either identity through the Identities API returns the same identity ID, so both identities share one Azure DevOps record.
• The Graph storage key API returns the same storage key for both identities.
• The stale identity is not listed separately in Organization settings > Users. The only entry there is the active user, so removing it would remove the real account.
• Checked against the current identity, the user has the right permissions on the area path (View work items in this node is allowed through a group). The mention fails only when it resolves to the stale identity.
• Deleting the guest object in Entra did not remove the alias from Azure DevOps.
• The DevOps audit log (90 days) and Entra audit logs (30 days) don't go back far enough to show when the identities were linked.

What we've tried

• Signed out and back in, used private browsing, and tested from several accounts and browsers. No change.
• Did not remove or re-add the active accounts, to protect their history and permissions.
• Did not recreate, redeem or resend the stale guest invites (as advised by support).
• Found no supported REST API, CLI or portal option to remove only the alias from an identity record.

Request

Could an Azure DevOps engineer please pick up support case 2610280050002044 and remove the three stale identities on the service side, keeping:

• the current member identities,
• their work item history, group memberships and licences.

Once it's done we'll test @mentions in work items and pull requests, the Assigned To picker, and permission lookups.

Thanks!