Entra Connect and Cloud Sync blocked from hard-matching users who hold Entra roles

Entra IDActive Directory

Who is affected

Hybrid identity teams that hard-match new Active Directory users to existing cloud users. Matching is now refused when the cloud user holds a Microsoft Entra role; soft match and existing synced users are not affected.

What to do

1. Remove Entra role assignments from a cloud user before you hard-match it, then reassign them.
2. Check sync error reports for hard-match failures since June 2026.
3. Keep privileged admin accounts cloud-only rather than synced from Active Directory.

Source

Upcoming change – Microsoft Entra Connect security update to block hard match for users with Microsoft Entra roles“Beginning June 1, 2026, Microsoft Entra ID will block any attempt by Entra Connect Sync or Cloud Sync from hard-matching a new user object from Active Directory to an existing cloud-managed Entra ID user object that holds Microsoft Entra roles.”

Checked 9 Nov 2026 Link to this deadline