Forum Discussion

RabbaniSYed's avatar
RabbaniSYed
Copper Contributor
Mar 06, 2025

Existing Admin Role Conflict in entra Portal

How to resolve the ad sync role conflict, installing the IDFix to get a noted of conflicting objects? or any other idea?? Thanks in advance..

  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Mar 07, 2025

    Take this:

     

    1. Use the IDFix Tool:

    • The IDFix tool is designed to identify and remediate conflicting objects in your on-premises Active Directory before syncing with Azure AD.
    • You can download and install the tool from Microsoft's GitHub repository.
    • Run the tool to scan for duplicate objects, invalid attributes, or other issues. It will suggest fixes that you can apply directly.

    2. Check for Conflicting Admin Roles:

    • Conflicts often arise when a user object has administrative permissions in both on-premises AD and Azure AD. Ensure that:
      • The UserPrincipalName (UPN) is unique across both environments.
      • The conflicting object is removed or updated in one of the directories.

    3. Remove Conflicting Roles:

    • If the conflict involves admin roles, remove the conflicting roles from the Azure AD object. You can do this via the Entra Admin Center or PowerShell:
    Remove-AzureADDirectoryRoleMember -ObjectId <RoleObjectId> -MemberId <UserObjectId>

     

    4. Re-Sync the Directory:
    After resolving the conflicts, re-run the Azure AD Connect sync to ensure the changes are applied.

Resources