Active Directory / Entra Hybrid sync error

Hello all, hope your week is going well!

I have an issue with several users not syncing properly from Active Directory to Entra.

Background:

  • We use Active Directory hybrid sync (one way) to Entra.
  • Most* accounts are syncing fine, but several recently offboarded users are not syncing changes to Entra from AD.
  • During offboarding, ~half a dozen attributes are changed in AD. No changes have been made to this procedure recently, same as always.

What I've tried:

  • I tried manually running delta and initial syncs.
  • I reviewed the Azure AD Connect app on the AD side of things, looks fine.
  • Checked "mS-DS-ConsistencyGuid" attribute in AD and Entra, they match.
  • I created a test user, gave him our standard attributes, synced to Entra, verified everything came through correctly (it did), then "offboarded" him. No issues whatsoever.
  • I did find that "Office 365 Sharepoint Online" made changes to the offboarded users more than a day after their accounts had been disabled in both AD and Entra, per the User Audit Logs in Entra.
  • The previous line suggests that Sharepoint Online may be touching the users in some way and causing the sync issues. I have no idea why this would be happening though, and why only to these specific users now? IF this is the case, then MAYBE this could be modifying the users in Entra enough that AD can't sync properly?

What am I missing? What should I be checking next?

Posted Aug 12, 2026, 8:28 PM UTC

110
Loading comments…