Wednesday, 17 October 2018

O365 - reverting hard matching migration using ImmutableID

 

This is a very obscure problem, so I’m recording this more for my own reference in future rather than expecting anyone else to have the same issue!

The issue occurs when a migration from a hybrid exchange domain to another domain which uses AD Sync has been completed in the following manner:

1.    filter/delete user in current domain

2.    AD Sync soft deletes mailbox

3.    Create user in new domain (in a filtered OU that won’t be synchronised)

4.    Obtain new account GUID and convert to immutableID string (base64)

5.    Undelete mailbox (mailbox becomes cloud mailbox)

6.    Assign ImmutableID to mailbox (from the target account)

7.    Move target account to a synchronised OU then allow AD sync to hard match the accounts

8.    For some reason, there is a need to reverse this migration.  So filter/delete user in new domain

9.    AD Sync soft deletes mailbox

10. Re-create or unfilter user in old hybrid domain

11. Obtain account GUID and convert to immutableID string (base64)

12. Undelete mailbox (mailbox becomes cloud mailbox)

13. Assign ImmutableID to mailbox (from the original account) using the command

  

Set-MsolUser -UserPrincipalName "<UPN>" -ImmutableId "<ImmutableID>"

 

 

At this point the following error is received:

 

Set-MsolUser : Uniqueness violation. Property: SourceAnchor.

At line:1 char:1

+ Set-MsolUser -UserPrincipalName user@domain.com  -Immutableid

 

 

The fix is to run…

 

 

Get-MsolUser -ReturnDeletedUsers | select-object UserPrincipalName,Immutableid,objected

 

 

Find the user with the ImmutableID matching the one you are trying to assign

 

 

Remove-MsolUser -objectID "<objectID>" -RemoveFromRecycleBin

 

 

Then you should be able to run

 

 

Set-MsolUser -UserPrincipalName "<UPN>" -ImmutableId "<ImmutableID>"

 

 

…if you still have a problem, find the user’s objectID with

 

 

Get-MsolUser -userprincipalname "<UPN>" | select-object UserPrincipalName,Objectid

 

 

And run…

 

 

Set-MsolUser -objectid "<objectID" -ImmutableId "<ImmutableID>"

 

 

 

 

No comments:

Post a comment