Share via

Deleted AD Account, but Cloud Account Did Not Transition to Soft-Delete

Bogyun Jeon 0 Reputation points
2025-10-15T07:40:05.29+00:00

The on-premises Active Directory is currently synchronized with Azure AD. After deleting the account on the AD server, the synchronized cloud account did not move to a deleted state.

Exchange | Exchange Server | Management
Exchange | Exchange Server | Management
The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jack-Bu 4,745 Reputation points Microsoft External Staff Moderator
    2025-10-15T11:24:20.31+00:00

    Hello Bogyun Jeon,

    Thank you for reaching out to Microsoft Q&A forum regarding the issue where an on-premises Active Directory (AD) account deletion did not propagate to cloud account in Entra. To confirm, please reviewed affected user synchronization status. If the user's "Directory synced" property in the Microsoft Entra admin center shows "Yes," the account remains linked to on-premises AD. If it shows "No," it may have become a cloud-only orphaned object. This usually happens because the sync hasn't run yet. Or there could be a specific error with that account leading to the account gets "orphaned" in the cloud.Here something you can try:

    Force a Full Synchronization Cycle:

    • Open PowerShell as administrator.
    • Run: Start-ADSyncSyncCycle -PolicyType Initial
    • Wait 5-10 minutes, then check the Deleted users section in the Microsoft Entra admin center. The user should appear in a soft-deleted state for 30 days.

    Check for Sync Errors:

    • Launch Synchronization Service Manager (miisclient.exe at C:\Program Files\Microsoft Azure AD Sync\UIShell).
    • Review the Operations tab for errors related to the user (e.g., by DN or GUID).
    • Address any issues, such as service account permissions or restarting the Microsoft Azure AD Sync service.
    • In the Connectors tab, ensure the user's OU is selected for sync.

    If the Object Is Orphaned (Still Active but Not Syncing):

    • This happens if the sync link broke. Confirm by checking the user's "sourceAnchor" (immutable ID) in Microsoft Entra ID doesn't match on-premises.
    • To remove manually:
      • Install the Microsoft Graph PowerShell module if needed: Install-Module Microsoft.Graph
      • Connect: Connect-MgGraph -Scopes "User.ReadWrite.All"
      • Get the user: $user = Get-MgUser -Filter "userPrincipalName eq '******@domain.com'"
      • Delete: Remove-MgUser -UserId $user.Id
    • Note: This is a soft delete; to hard-delete immediately, go to Deleted users in the portal and select "Delete permanently."

    Please try these steps and let us know the outcome, including any error messages. I'm here to assist further

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".      

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.