How can we help?

Articles in this section

See more

Duplicate Users in Hybrid Microsoft 365 Tenants: UPN vs Email Mismatch

Evan G
  • Updated

This article explains why CloudRadial can create two user records for the same person when a client's Microsoft 365 tenant is hybrid (synced from on-premise Active Directory), and how to fix it depending on whether the client uses Microsoft 365 single sign-on.

In this article:

Why duplicates appear

CloudRadial merges a Microsoft 365 user and a PSA contact into one portal user when their email addresses match exactly. By default, CloudRadial uses the user's User Principal Name (UPN) as the email address on the Microsoft 365 side.

In most tenants the UPN and the primary email address are identical, so matching works. In hybrid tenants they often differ. A common pattern is older accounts created on-premise with a short UPN (for example jsmith@contoso.com) while the person's real mailbox is john.smith@contoso.com, and newer accounts created directly in the cloud where the UPN and email already match.

When the UPN does not match the email stored on the PSA contact, CloudRadial sees two different people:

  • One user synced from Microsoft 365 with the UPN as the email
  • One user synced from the PSA with the real email address

Running the Remove Duplicate Users lab merges them, but because the sources still disagree, the duplicate comes back on the next sync.

How to tell if this is your problem

  1. Go to Partner > Clients > Users for the affected client.
  2. Sort or search by last name and look for pairs with the same name but different email addresses.
  3. Check the Source column. If one record shows Microsoft 365 and the other shows your PSA, and the Microsoft 365 email looks like a UPN rather than the real mailbox, this is the cause.

Typically only the older on-premise accounts are affected. Cloud-created accounts match normally.

Fix option 1: Match on the Microsoft 365 email address instead of the UPN

Use this when the client does not rely on Microsoft 365 single sign-on to log in to CloudRadial, or when SSO still works for them with this setting changed.

  1. Go to Partner > Clients.
  2. Use the blue 3-dot menu next to the client and choose Edit.
  3. Under Office 365 Synchronization, uncheck Use User Principal Name (UPN) as email address?
  4. Click Submit.
  5. Re-sync the client (select the client and use the Sync option, or wait for the overnight sync).

CloudRadial will now use the mailbox email address from Microsoft 365 as the matching key, which lines up with the PSA contact. See Syncing on User Principal Name (UPN) for details on this setting.

Fix option 2: Make the UPN the primary email in your PSA (required when SSO is in use)

Microsoft 365 sign-in identifies the user by UPN. If the client logs in to CloudRadial with Microsoft 365 SSO, the CloudRadial user's email must be the UPN, so option 1 is not available. In that case the PSA contact has to be adjusted to match instead:

  1. In your PSA, open the affected contact.
  2. Set the contact's primary email address to the user's UPN (for example jsmith@contoso.com).
  3. Add the person's real mailbox address (for example john.smith@contoso.com) as a secondary or alternate email on the contact so ticket notifications and replies still reach them. In HaloPSA this is the additional email field on the user record; in ConnectWise use the Email or Home Email fields.
  4. Leave Use User Principal Name (UPN) as email address? checked in CloudRadial.
  5. Re-sync the client.

CloudRadial matches on Microsoft 365 alternate emails as well, so once the PSA primary email equals the UPN, the Microsoft 365 user and the PSA contact merge into one portal user and SSO continues to work.

Tip: For clients with hundreds of contacts, export the user list from Partner > Clients > Users and sort by Source and email to build a worklist of which PSA contacts need updating. Fix the PSA records first, then run cleanup.

Cleaning up the duplicates that already exist

After the matching key is corrected using one of the options above:

  1. Go to Partner > Account > Labs.
  2. In the Users section, run Remove Duplicate Users for the client (or for all companies).
  3. Re-sync the client and confirm each person now shows a single user with both a Microsoft 365 and a PSA source.

If duplicates return after the next sync, the matching key is still mismatched for those users. Re-check the UPN and the PSA primary email for each one.

Labs are described in CloudRadial Labs.

Related articles

Comments

0 comments

Article is closed for comments.